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FOREWORD 



The use of comput#s^to automate the informai/on handling and record-keeping, 
.activities of qovernmenl and private organisation/ has brought the benefits of speed 
4nd efficiency to these operations. But "'it has silso ^rought concerns for privacy 
stenunmg from the desire of individuals to control the collection of information* 
about themselves and to exercise some jijeasure jbf control over the use of that 
information. ' a / 

•■./■,; ■ , ' 

Consideration of this basic issus — how to utilize the benefits of technology 
while preserving individual rights — ^ha^^ed to public policy regulating the use of 
personal information in credit reporting and Federal record-keeping. 

Medical record-keeping is an ar/a af special concern and br©-ad<lmpact for the 
development of sound public policy respecting privacy rights. Computer technology^ 
applied to^edical records ^offers promising bene,f its of' increased efficiency and 
improved /ea 1th care. Advances m computer and communications technology could 
enable doctors m remote areas to have ready access to relevant information. The 
analytic power of 'the computer could be used. in medical diagnosis. Medical' research' 
couiid be advanced through computer analysis of existing medical records. 

V However, this is a sensitive area where privacy concerns are strong. The 
National Bureau of Standar<^s has sponsored this study of the privacy issues m 
medical record-keeping to advance understanding of the attendant privacy problems and 
their ^possible solution. * This report, Computers, Heaj^th Records and citizen Rights , 
IS the result^ of a two-year research effort directed by Dr. Alan F..^ Westm, Professor 
of* Public Law and Government, Col*umbia University. Dr. Westm is the co-author; of 
Databahks in a Free Society , _the Landmark study of computers and privacy. 

We offer Dr. Westm's recommendations to the health care and medical community 
^for their consideration vdth the hope that these, recommendations will help them 
develop policies* tha,t assure the protection of individual privacy rights. As the 
first thorough investigation of privacy issues in one sector of American society with 
sector-specific recommendaitions , it should provide helpful insights ^nd a model 
metH'odoiogy fpr studying privacy concerns in other areas. Towards this end, NBS and 
the Privacy Protection "Study Conmiission are jointly sponsoring a fDl3,ow-up study by 
Dr. Westin on personnel record-keeping practices. ' ^ 



Dr. Westin 's study deserves wide review and careful consideration. 
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PREFACE 



This report has its origins in a Workshop on Privacy that met in Gaithersburg, , 
Maryland, on February 8-9, 1973. Sponsored by the National Bureau of Standards and 
the Association for Computing Machinery, the group included experts from the computer 
community, law, the social ^Jsiences, public interest and civil liberties groups, 
federal executive agencies, and state legislatures. 

Looking oyer the then-current state of tl)e'-€omputers-^d-privacy issue, the "work 
^shop saw the United States entering a new phase of this problem. In the mid-1960s 
' there had been early alarms about the potejitial impact of computer technology on 
citizen rights. This was followed between I968 and 1972 by a period of empirical 
stt^ies and legislative inquiries ,' probing just wh&t the -effect of ^omputer use by 
organizations had been so far. Now, the Workshop concluded, . having Lrceived the 
threats and mapped the issues f the nation was moving int-o- a period ok policy 
definition and regulatory action. ■- ■ ' ' | 

This new period would not be a short one. The Workshop was agreed that^no legal 
or technological "fixes" could be applied quickly and comprehensive ij to automated 
personal data 'systems. The basic issues involved in organizationkl riecord keeping 
about people involved fundamental debates for American society over changing social" 
values, new definition? of civil liberties', controversial gover^ent Irograms and 
business services, and shifting conceptions of proper and improper organisational 
authority . In addition, computer and communication technologies were Ihighly dynamic 1 
their continually changing capacities, problems, and opportunities would -rjsqu ire very 
sensitive., and flexible policy mechanisms,, continually reviewed. \ 

The Workshop saw the middle 1-970's as a critical period in the development of 
soun(J public policies'. The empirical reports and hearings of the I96941972 phase had 
alerted the medigi, the public, and national policy-makers to the need ftr action, and 
a wide variety of standards-setting proposals had been presented to legislatures,' 
regulatory agencies, and organizational managers. ■ Because many of thesi would ' ' 
involve far-reaching- and expensive changes in the operations of major bisiness and • 
goifernment functions in American society, they required a careful assessment, were 
^they-respo^sive to the real problems of citizen rights in a given situatjion? what 
•was- tfeeir^otential impact on the informational needs of organizations akd society? 
did thfey jhave the right blend of guiding principles, specific rules, realistic 
procedures, and enforceable remedies? 

> Most important of all, the Workshop was concerned that the public's j cle^- "'desire 
for,new privkcy protections be channeled into law in time to catch the wave of large- 
scale systems building and adoption of f ourthTgeneration computer-system technology 
that was expected- to uhfold in the middle- and 1^1:6^1970 's The '^^articip^t? ^at^^tfie 
Workshop were agreed 1;hat many of the proposed protections for indivfduai rights 
would- be "affordabie" in dollar costs if these were spelled out as systel requirements 
as^the new systems were being designed, or as existing systems were undergoing major 
expansion.. What would be painful or even unbearable, in terms of cost, ioufd be to 
J^ait so long to formulate broadly-acceptable s'tandards that .information lystems, as 
'Dr.' Ruth Davis put i^t .^^jjfould have to be "retro-fitted" tp conform to the| new rules 



The Workshop speculated that new legislative policies in the middle Seventies 
would be likely to follow two main lines. One would be the enactment of broad 
"fair information practices" laws directed at the record-keepipg of all agencies at a 
particular level of government, and covering both manual and automated data systems. 
.(This appf^>4ch, based on recommendations of the HEW Advisory Committee on Automated 
Personal Data Systems*, was soon well under way, and has already resulted in the 
- ^enactment of the Federal Privacy Act of 1974 and similair laws in five states.) The 
second line of legislation would involve the passage of law^ to deal \fith particular 
fields of record keeping, where detailed codes would be enacted to define citizen 
rights, ywork out balances among conflicting social values, and set specific mechanisms 
of supervision and enforcement. » 

^ To help bo^h policy maJcers and systems developers evolve a set of basic standards 
during this earl/ regulatory phase, the Workshop felt it would be valuable to conduct 
a series of interdisciplinary studies, following the approach of the National Academy 
of Sciences* Project on Computer Databanks. That project had produced, for ea^ch 
field of organizational activity^ (1) a description of the pre-computer baseline of 
record-keeping practices and citizen rights rules; (2) an empirical study of how 
computers were being used there and ^the effects this was having on the operations of 
personal record keeping j and (3) an analysis of" policy alternatives available to 
insure that society's current expectations aboiTt citizen rights \p that field were 
carried out, in both automat^ and?manual data systems, 

^Looking over the main fields of organizational re cord -keeping about people,, 
Workshop identified a group of these that seemed to merit priority Attention, based 
' on factors such as the number of persons affected by these activities, the extensive- 
ness of computer us^, and the readiness of lay and public opinion to take up <> 
^regulatory alternatives. The fields selected werej banking and finance; credit 
'bureaus and c<Mamercial reporting agencies; education; personnel practices; social 
ajid evaluative reseairch; law enforcement and criminal justice; welfare; and health 
.care. * i , 

The WoVkshop decided that the best course was to select one field and do it a 
mo|iel study. Once this was conducteci and. published, its technique oould be evaluated 
and, where it proved relevant, used by other researchers t organizational managers, 
and government study commissions. Far reasons that will be noted in the Introduction, 
health care was selected to be the first field treated, and the Institute for Computer 
Sciences and Technology of the^ational Bureau of Standairds was able to provide the 
fundk to carry out . the reseafcfff ^ - , . / 

This pilot project having been completed, the Institute is now ^Onsoring a 
second study, to be conducted during 1976-77. It deals with the' pefsonjiel data 
systems of government •agencies , .b^isiness, and non-prof it .orgai^i'zations , ^d is being 
funded jointly, by the I^ational Bureau of Standsirds and the federal Privacy Protection 
'Study Commission. ' " ' ' * . ' ^ " ' ^ ' 

' *Records,' Computers, and the RlBTts d'f Citizens. Report of the Secretary's AdvisoVv ° 
Committee on Automated Personal_Data Systems. U.S. Department Of Health, Education,, 
^and Welfare, July, 1973, dHEW Publication No. (OS) 73-74. ' . . 

**QiSrLgll^*l972"f'*"^°^^^"'" databanks in a Eree Sooi fltv 'f Wp« York: 
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While many persons and organizations aided in the health care 'study (and are 
hatefully mentioned in the 'Acknowledgments section of the Appendix) two persons 
Reserve to be noted here ks the sustaining godparents of 'this work: Dr. Ruth M.Davis 
Director of the Institute for Computer Sciences apd Technology of the National Byreaii 
of Standards, and Mr. Walter M. Carlson, first- in his capacity ^as. President of the 
Association for Computing Machinery, when the Workshop\ofi Privacy was creai:e'd, and 
since then as an advisor to N.B,S. Their patronage wasi in 'the 4)est of the 
Renaissance tradition. ' ^ >• • 

• , ' Alan F.^We^tin, " 

' f . ' ' March 31 • 1976 - 
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A "NOTE TO READERS 



.ERIC 



Tljough the Pg^oject on Medical Records and Citizen 
Rights is <?omi)leted, the Director would welcome comments 
from ^eadeps about tj>e.. facts- presented,- issues raised-, 
and^x^eommendations presented in .this Report. Additional 
examples of intentional or unintentional violations of 
individual rights in medical records and health data'would 
be particularly welcome^ as well as^new policy problems 
that may have arisen too recently to have ^en'' included 
in thisjgtudy. Such^matef ial will be used in an updating 
of this Report. to be published later, in a general forum 
available to all -interested parties. 

^ «• 

Plea^^ send such communicatiorvs to: 

Ppofe'ss'or Al^ P. Westin ^ 
Department* or* Political Science" 
729 -International Affairs Building ' 
• Columbia University 
New York, N.Y^^10027 
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^ ' ^ ^ EXECUTIVE -SUMMARY 



Background . • ' "x^^ 

The concept of this mpdel^study originated in a Workshop on PriVacy held m 1973 
under the auspices of the AssociaUon for Computing Machinery and the' In^itute for * 
Computer 'Sciences and Technology, Nk^onal Bureau of Standards. The work^b^believed 
It would be valuable to select one impor^^t area of record-keeping about people th^t - 
was uAhergoing significant computerization^^d conduct a study that woj^ld identifyxthe 
standards to be installed if society is' to realize oenef its from information x 
technology without jeopardizing fundamental citizen rights,. ^ . y " 

Health care was chosen foi^ the pilot study for several reasons.. These include «t 
the universal impact of health-care records on the population; the fundamental recon- 
sideration of goalkand organization in American health care now taking 'place ; the 
imminence of some kind of national health insurance plan; the increasing use of computers 
in health care; and current debates* over the right of individuals 'to control the uses 
made of their personal health data. , Funding for the study was provided by NBS. 
Objectives and Methodology 

The study had three 'objectives: to describe the ,pre-computer baseline of record- 
^ keeping practices and citizen- rights rules in health organizaj^ions ; to conduct an 
empirical study of how computers were being used there, and the effects this was having 
on the operation^, of personal record-keeping; and to identify the principles and policy 
alternatives that would assure ols^rvance of citizen rights m emerging data systems, 
especially the automated ones. 

Research was conducted by a smalT; intjsrdisciplinary team under the directi>on of 
Alan P. yestin. Professor of Public Law and'Oovernment , Columbia University, beginning ^ 
in the summer of 1974 and finishing in Api*il, 1976. Examination of^bli^hed litera'ture 
from medicine and health, law; computing, and social science was augmented by interviews 
with major computer manufacturers , systems developers, and civil liberties , public- 
interest,^ coij3umer, and minority-rights groups. On-site visits were made to six. rep- 
resentative health-care organizations usinV computers to handle personal records, with • 
detailed profiles written of each organizalion.- Correspondence and follow-up contacts 
were conducted with 70 organizations in the health care fiej.d. A draft report of the ' 
project's findings and. re.cDmmenda$ions was reviewed at a conference of experts in 
Set)tember of. 1975, and^th^n by approximately 50*outsi'de reviewers. Following\this , the 
Director^and a professional writer re-wrote' the report to reflect suggestions from the 
reviews and additional research. The final report's presentation and reqommendationS 
are solely the responsibility .of the Director, and have not been subject 'to. an;yr clearl- 
ance process by the project staff or the sponsor. ^ 

* - • 
Part I; The Record-Keeping Baseline - • ' 

Jis a baseline for studying the impact d'f computer, use in health .care, the report ] 

describes three different zones in which individual health data is used, each with 

different social norms and legal rules as to rights of -privacy, confidentiality, and 

individual^access. ^ * ' ^ 

A. In Zone 1 , primary h ealth care ', the report describes how medical records are 
used when a patient seeks help from a health* professional ,* whether %n a physician's 
office^, a clinic or hospital, or the health unit of an institution (colleges. 
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corporations, the military, etc.)". Though the importance of promoting full disclosure 
by. patients to doctors has produced 'a long-standing ethical duty of confidentiality, 
and legal privilege against courtroom disclosure in mo3t American states, the report 
shows how the-growth of third^party , payment^ for medical care, utilization reviews, 
and, the growixig use^ of health data for social decisions have seriously weakened the 
. observance of'st,rict confidentiality. . . , 

Th6 study found that the requirement of -"informed consent" by patients' to 
release of their primary care data is rarelyjwell observed ^today. In part, this is 
because consent is often coerced by the threat of losing services or is assumed to 
be implied* Informed co^isent is also weakened because patients do not have a 
general right to see what is in their records, either before the figita is released 
^to third parties or as'^a matter of patient interest during t^egular care. 3uch . 
problems of consent and access are beiAg exacerbated in institutional health car^,*" 
where physicians are employees of the institution and have mixed loyalties in 
handling patient information, ' ' 

Overall, the main finding of this section is that identified patient information 
from medical records now flgws regularly" out of the prmaj^y care .setting in ways^hat' 
allow po-tients few controls over these disclosures, 
) • . 

B. Zone 2 covers use of medical data fojr payment of services and qualLty-of- 
care reviews , For^ the 190 million Americans ' whose bills arp pAiri, i ^^ pa^v ^f hy 
private insurance ^coverage 6r government medical programs, the, legitimate need for 
payers to determine eligibility, assess claims, ai)d detect provider fraud has 
created a system in which reports of sensitive diagnoses and condi^tions are forwarded 
from primary care records. The study found considerable disagreement between 
medical professionals and the payers, as to how much personal data from medical 
r^^cords realiy n^eds-to be disclosed for the payment- review function, an issue of 
privac^y that is particularly sensitive where review of psychiatric cpndit^ons^is 
involved,," The -study also found that existing practices have not prevented leakage 

of personal medical data to persons whom the individual did not want (or consent) to 
-"have access to such facts r such as employers or fellow-employees in ^rottp health plans 
or government-agencr employers/ Questions have also been raised about how long 

, personal ^data need to be retained by payers, and whether subscribers suid aid 

^ recipients should have th§ right to examine their recofd^v 

As to utilization reviews an^ quality-care as^urahce, the study found' thlit the > 
use of these processes has not raised serious citizen rights issues up uiitil now. 
However, the creation of the new PSRO review system for Medicare and Medicaid has 
generated considerable controversy over how patient and physician privacy wall* be 
handled * * ^ 

C. In Zone 3, social uses of health data , the report details how American 
society has come to require the" disclosure of personal health data to serve a wide 
range of other^ important intere&ts, from 'employment life insurance, welfare, arid 
rehabilitation to law enf ojrcement , social research, licensing, and jirevention of 
^ild abuse • iftw to adjust the balance betwefen claims of medical conf idefitiality 
and legitimate so€;ial programs ^clearly requires cArefta assessment area by area. 
However, the report finds rising criticism: of the use of health data m many of 
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these areas to make what are challenged as stigmatizing and aisapiminatory judgments, 
&bout- people , This involves disabilities' agaUnst peraons who" have^'had psychiatric 
treatment; or various kinds of non-disabling physical ailments, or whose practice of 
, homosexuality is^. supposed to make th^m greater health risks than heterosexuals, or 
vroqei wiio have tad abortions, or persons who >a^li^to kejip confidential. the fact that 
they are undergoing drug or al.cahgl rehabilitation. In the post-.Watergate .jnood , the 
protests have been particularly sharp whe^ it is government agencies that ihsist 
upon recording such sensitive health d^ta ana using 1% to control the individual's 
rights' and opportunities. " » ^ ^ * ' ** 

D.-In all three zones, the report concludes that traditional laws and organiza- 
tional policies have not kept pace with the ?ie^ flows and uses^^of health information 
throughout our society, and that sWdards to resolve the growing policy debates 
are lacking in many sectors of the national health care system. This-leavJs computer 
systems developers in- heal^th care without clear policies to' guide the automation 
of file^ and assjemblage of data systems. • ' ' 

Part II; Patterns of Compute rizati.on in Health Care, and Their General' Citizen 
Rights^^lmplic^tions * \ ' ' ' ,• ^ 

A. The , study examined curre'nt patterns of computer use in each ot the thr6e ' * 
zones. While automation in Zone 1 , primary care, has been ^slight in the physician's 
offitj'e, the criish of paperwork in large clinics and hospit^s.for billing and , 
accounting-, third- party payment, reporting duties, lab' tests , 'akd. similar areas has 

.produced extensive computer 'applica'tions. The development of .ii^tegrated-f ile , 
databank-oriented hospital information systems, though mu6h dis^ssed in the • ^ - 
technical literature and the general press, rejnains largely at the -pilot stage 
where if is being attempted. Overall, the main effects on citizen "rights of 
^^^J^^.^i'. applications to patient records in jSrimary care has teen to increa^^^^he 
systematic collection, recording, and centralization of patient data, both social 
and medical; this -^^ends to sharpen questions of just what^data ought to be recorded, 
how long it should, be kej)t, what release^ procedures are to be used,* aiid 'Whether 
patients will be able^to inspect-^what is in their records. , ' m:^ ' 

B. In Zone (2, service payment, computer use has been wideppre^ throughout ^the 
health insurance industry, with increasing amounts, of patient data being bollected' 
and stored in thefr files. While no special problemsKf leakage have appeaf^d' as 

a result ^bf computer use per se, unclear policy definition as to what identified 
data should be collected for ^payment reviews. and who else should get^such data are • 
central issues here. ' ' - * . 

■f. • ' • - 

01 In Zone 3, the report did^not try to describe how computers are being used' 
in the dozen or so major ^reas^ of social activity th^at use health data to support* 
their fujrittions. However, one^ Zone" 3 area whose computej^ use wa^ examined was 
automafio^ by governiient health-administration agencies, which have increasingly 
been oreai?ing controversial databanks of identified patient^^data for p;.annin§, " 
evaluation, and research purposes* { ' * 

xiii . . . • 



.D, Overall, the survey of computerization in health gare founH^that automation 
has not been as extensive as in fields such as bajiking, law enforcement, or taxatioja, 
though it is growing steadily in use and sophistication. Some observers feel that 
a sharp take-off in health compulsing i-e aboJ^ .>to occur, as a ^result of rising costs 
^requiring closer record-keeping'contrpls and the likeiy prospect of national health 
/insurance* However, expansion of computer use for hospital information systems is 
not seen as imminent,' owing to the absence of conceptual models of how information 
use^ in the hospital ijould be reorganized in ways that would be both cost-effective 
and acceptable to health professionals and the public. 

Part III; Profiles of Computerizing 'Organizations v • 

To- examine how 'onganization^Cl policies and computerization efforts are affecting 
citizen rights, the study presents detailed profiles of six organizations involved 
in automat?.ng ^rsonaL health records, ^ .~ . 

A, Los Angeles County Medical Center is a large county- facility primarily 
serving the urban poor anS minority groups of E^t Los Angeles,' It is an average 
or "maijistream" computer user, with a project ^feti^oM.te medical records 
databank to improve patient care. The pr9file ^ows that the factors whieit shape 
basic citizen rights policy are the pressure on the Center to recoveu costs, leading 
to an empha^s on collecting extensive personal data; the Center* s cooperative' 
relations wi€^ local government and police officials seeking patient data; and i 
"ghetto-crisis* medicine that has no place for sug^ "luxuries" as giving patients 
access to records or obtaining truly informed" cojifeent before releasing patient 
information. Computer use at the Center" incDrribra^es* these basic problems and 
^reacftive policies. The yeport concludes that it^j^fiiU ^ take a '^combinatidn of new 
patient-rights legislatiolJ^'and reorientation of staff resource^ and priorities to 
install significantly greater citizen rights in the Center »s operations, and that 
this will not tak^ place any sooner" — or later — as a result of the Center* g. 
plans for further computerization, ^ 

^ ;B, The Dr, Margin Luther King Jr, Health Center is a federally-funded, private ' 
facility providing ambulatory care in a high-poverty area of the Soiith Bronx, in 
New York City; it supplies comprehensive, family-centered health x;are to approximately 
40,000 registered patients, with a staff of 450, Computer use has been of the 
"^'mainstreanl" 'variety, but this C^nter^s emphasis on the health-,team approach-to care, 
its 'heavy use of community people in staff and decision-making, its inn©vati«ve 
policies and practices as to patient rights presents a fusion '.of computer technology 
and citizen rights that is very different from that of Los Angeles Med^-c^ Center, 
even allowing for the differences between acute and flhbulatory *care. Th6 report 
regards as exemplary .th<^King Cen^ter*s philosophy that machines must facilitate 
rather than weaken the Center's basic commitment to patient dimity and social 
advocacy , • , ^ ^ . 

C. The Kaiser-Permaneiite MedJ.cal Carg Program offers the experience of.:>a SiV^ 
year, ** leading-edge" project on computerized patient records in t^ Oakland-San 
Francisco area, which was aime^^at eventually creating a ."hospital information 
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system." As a pre-paid medical plan that is both medical provider ^d insurer, 
Kaiser serves primarily middle class and unionised workers, and its health care 
has been excellent. It gave careful- and effective -attention to .citizen rights 
in the Oakland project, especially as- to access controls over patient data' stored 
in the computer system. The federal grant* to Kaiser wfis not renewed in 1975, and 
while the report jdiscusses the different explanations for this withdrawal of funds, 
.the treatment of the Kaiser project underscores , the uncertainty of funding a^ 
organizational, problems tha^ faie leading-edge pe^^^in the hospit^ field today, 

The U,S. Indian_*«ealth §ervice operates an advanced health information ' 
systems- pVojebt in Tucson, Arizona that maintains i'ntegrated, on-line medical records 

for approximately 10-12 thousand Papago Indians in South^^rL^A^ci^^ 

.has helped greatly j^ith'some of the special problems of record-keeping raised by an 
'itinerant patient population, and has generatedVxcellent' admini^rative reports, 
the 'computer .project has not been able to do mucfi#about the desp^^e medical' 
condition of American Indlan^s m Arizona and elsewhere and the glaring inadequacy of 
federal funds and facilities being provided to- cope with these health problems; in 
fact, the improved reporting only highlights the ^problems more •5harply,^' Tl^e study 
found that the Indian Health Service has be^n sensitive to special Indian attitudes ' 
on privacy but that problems of confidentiality of records and issues of patient 
access remain, Ttese are now being address^ under the new provisions of the 
Federal Privacy ^to£l974;^ and the report notes some of the initial problem's that 
have arisen in ii^P^menting those policies in the Indian Health Service, 

E. The Multi-State Information System (MSIS) is an automate,d information system 
containing records on about 400,000 mental patients. It' serves both administrative 
^ and research purposes for participating institutions (primarily state dnd private 
mental health facilities' in the Northeast) ^d the i^earch activities of , the 
developer and manager of the system, the Informatiap Sciences Di-vision of Rockland 
Research Institute, a- state facility in Orangeburg, New York. MSIS has pioneered in 
securing a special sta^e statute to . safeguard the conf idelktiality of the sensiigive 
^psychiatric jiata that it stores, But^it has also. been the target of considerable 
attack because it creates a new type of centralized, regional databank of ident^^fied 
.psychiatric information, separate Vrom and in addition to the recoils kept in the 
participating mental facnijies.^ The i^eport notes that prividing strong safeguards 
for such regional and national 'information systems, containing special medical d,^ta. 
is Tsi)ecially important in the post-Watergate climate/of public concern over govern- 
ment abuse of confidential record's, 



, , Mutual of Omaha is a profit-making, multi-line insurer which is not onl|* the 
largest provider of private health insurance in the United States but also an |, ' 
advanced computer user, ^TKe report traces the citiaen rights issues irivolved if \. 
un<^erwriting decisions and /claims investigatiok at Mutdajl, and the compliance of[ the • 
firm with important protective legislation .such as the Fair Credit Reporting Ac! 
■and the Federal Privacfy Act (the latter because Mutual is ^ fisc^' intermediary ^^der 
^ several federal health-payment programs). The report finds that Mutual^s use of 
computers^has followed rather than altered its basic confidentiality policies, has 
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probably enhanced the security of s^'scriber data, and has. not ^interfered with 
Mutual's compliance with federal2:aws , ' The key issues^of citizen rights facing 
Mutual and all other health i;i^ers,^ the study notes, are issues of social policy, 
such as how far American socaety will insist upon socializing certain, risks 
(insurance of homose-xuals , forbidding "objective" but racially- based standards, etcT) 
and thereby alter- the colj^tion and use of personal data that now support industry 
practices in "thesV_>^«^^ 

Overall, the six profiles showed that th^deploymen^ of computing and 
communication by he^th organizations is still essentially a matter of organizational 
artistryV not management science, 'Computerizing requires managers to exercise choice 
in selecting the 'files and data flows to automate, arranging configurations of 
hardware and terminals, writing software, defining operator-machine relationships,, 
setting patterns, of datd-sharing inside and outside the organization, deciding* on 
levels of organizational monitoring and reporting, and reviewing what types' of data 
collection, -pat j.ent consent, and access-to- record rules the organization tradition-' 

-ally provided and what it will now provide in its automated^system. While* some 
important ef feqt't^' are being exerted by new laws, the real Icrcus of decision-making 
today as to how "citizen •igiits will be .treated in these new systems' still lies with 

^ organizational managements. 

Part lY: ?olzicy Alternatives 
Z. ' ' ' 

Computer Impact on Citizen Rights • » 

ror crucial backdrop, tjjte report notes the social setting in which ^health-care 
computerization is unfolding: distrust of the computer by various disadvantaged groups 
as an instrument that continues discriminatory practices agaihpt them; widespread pub- 
lic sk^epticism about the delivery and/or value of many "data-based" government social 
programs; general distrust 'of the government's motives ajid respect ^or confidentiality 
rules, in the pos t-Vatergate mood; rising "consumerist" challenges to many traditional 
practices in the health field; and a clear public consensus by the mid-1 970 *s th§it 
rules tQ(^rotect citizen rigtits must be instituted when large-scale systems of personal 
da-fe are Instituted by government agencies and private organizations, J 

Turning to the impact of computer use in health care, the report found that i^t . 
cases of actual barm involving individuals' were still arisifife from manual records, 
^These re&ain the places where most sensitive medical record^ and health dataware stored 
and, tJirough which transfetrs of data are still effectuated. The project also found that 
as a whole, computerized health records are more securely kept and processed today tha/i 
manual recD:^ds, with instar;pes of leakage or misuse discovered by the pro ject-. almost 
always taking place in manual files, 2 ^ .. 

*The report concludes that .the main problem today with use o?"autdmated medical 
records, involves potential harm - the creation of health data systems ^at many health 
prof^qionals, citizen groups, and individuals directly affected by such systems con-, 
sider to be ' threats to basic rights, 

-'-The report then prese^nts descriptions of some two dozen selected episodes in which 
government agencies or private organizations either announced o^r set up health data 
systems 'only to encounter co^certM opposition from various local groups for failing 
to define an'd safeguard citizen rights in those ventures • Among the data systems 
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described are state health department discharge reports; state mental health 
department case reporting files i state welfare department client-services reports 
medical notations in juvenile court and police recordsj state data systeijs on 
^ndicapped children j state "abortion surveillance" reporting j citjr and' state 
re^'istries for fetal death, Ichild abuse, drug prescriptions, and narcotics treattaent 
state databanks^^consolidating records on all social services, received by state' 
residents; state beneficiary-explanation mailings to identify provider fraud j and 
the Medical I hf-ormat ion .Bureau system for life-insurance company data "exchange , - 

After analyzing what had happenetd and why in these e^is ode a,, ^he^ chapter » 
concluded: \ . " i 

"fVost computerized health data systems are being created or expanded- witHout 
sufficient consultation in adyance with groups representing citizen- 'rights and ' 
docj;or-patient interests, and without -some kind/of proceeding 'open to' the gez^(?rai 
public. Yost data systems lack sufficiently developed analyses of how much and ' 
what kind df identified"^ personal data they really, need to perform their function; 
Even when properly defined," most data systems fail to adopt sufficiently precise 
^standards of confidentiality, controlling uses within the organization and release 
,of identified d^ta to -third' parties . When it comes to rules for permitting patient 
access' to their own records, very few computerized organizations have adopted . » 
procedures responsive t^ those patients who ask for and insist upon a'ccess.<, .'.What 
we have today are ambiguous and ill-defined systems that leave people uncertain and 
fearful about their capacity to control the circulation of their medical and health 
data." 

Comparisons With Other Demt>cratic Nations 

to compare American, progress in health-care automation and protection of 
citizen rights with the experiences of other industrial democracies, the report 
surVejfed these issues in approximately two dozen other nations, presenting country 
reports on six of these: Britain, Canada, West Germany, Australia, France, and 
• S^yeden . ' I * * 41 ' 

As far as computer use, the main conclusions of the survey are that automation 
is extensive and w^ll-^st^blished in the health institutions of these nations but 
is still heavily centered on administrative and laboratory applications in hospitals, 
and administrative applications in health^insurancl programs; that leading-edge 
hospital ^ptems and regional hfealth' infprmation ^^stems are still.^iri. experimental 
stages with their work on patient records, though these are aided by the pre^gnce 
of unique citizen numbering prac;tices; and that automation efforts have encountered 
many of tKe same problems of pi^oving cost- justification, overcoming professional 
opposition to computers , ^and competing for funds with other social programs as in 
the United States. * - - ' ^ ' / 

: As to prote(mOT-bf citizen Ttgh±« ,/the report finds that public debates over 
protection of privacy 'have followed the same patterns in these nations as in the 
United States? that many of these nations have developed principles to be followed"* 
in computerized data systems that;clos^ resemble the American concepts of fair 
information practices Established by the Federal Privacy Act of 1974| and that it is^ 
in the jne^chaniams to install, ' administer , and enforce those principles that the main 
differences lie between the .United States approach and that of. other industrialized 
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democracies. As a prime example, the report describes the data inspection and 
registration approach takenjW Sweden and how this has been applied so far to . 
medical records and hospitaj^l^tems . This section concludes by noting .that most 
Western nations are at the same stage as the United States in this area, aware of. 
the problems but just beginning to enact and administer protective laws to safeguard 
individual rights in steadily-expanding health data system, - . 

^ ■ . Y ^ 

Policy Analysis and Recommendations ' » 

The concluding chapter begins by stating that no single law, judicial ruling, 
regulatory 'action, or orgaiiizational policy can hope to deal with the tremendpusly 
varied and complex issues of citizen rights in health record-keeping; dt will take a 
mosaic of policy actions, over**time, to do what' is needed. However, the report 
stresses that these actions must begin to be taken now, rather than assume there 
is time to wait until national health insurance is enacted or a reorganization of 
the American health -care system is completed. ^ 

As background, the report presents a set of concepts that have developed during 
the past. few. years as basi^ principles to ^be i'ollowed by any l^eirge-scale data system " 
using personal records. These airei -adopting a "con\;ract" as well as civil-liberties 
theory of informational privacy^ recognizing certain special dangers in automated dat 
systemsi setting primary Vesponsibility with the "keeper" o^ each data systemic 
identifying a legal duty to take reasonable caire in the- use of personal data and * 
specifying the standards required to meet such a dutyt^^^n^AC]^ fielrfj issuing public 
notices and privacy -impact statements when data systems Sre, created and expanded? and 
providing independent, outside reviews of the operattbns of each data system. 

Applying these concepts to health data 'systems , the report presents 12 major ^ 
principles that ought to be followed in 'the management of data systems in the health, 
field, and discusses alternative ways that.' these principles might be ceirried out. 
The 12 principle's arei 

1, There should be a procedure for issuing a public notice and privacy-impact 
statement whenever an automated data system is created in the health field, filed 
with an appropriate outside authority and communicated to any continuing population o: 
individuals whose records will ^be affected, - ^ . 

2, Socially-acceptable "standairds of relevance and propriety in the collection of 
personal data should be worked out for data systems iii each of the three zones of. 
health-data use, through public discussion and appropriate policy-setting mechaniims, 

3, Individuals should* be given a clearly-written accoutit of how tlie/fr personal 
information will be used whenever they aire asked to^pply personal information to 
a health data system, along with the procedures to be followed before any uses are 
ma4e of tftefir' data other than those originally specified, ' . 

Forms used to release personal information from a health data system should 
be for a specific purpose, describe the^ information to be released, and should be 
liinited ,in time, an^ the individual's consent to such releases should be informed as 
well as voluntary, ^ ^ ' 1^ 

• 5^ As a general matter, patients should have a right to full information about 
theiD^health conditiorjs. Where" health data is to be used to 'make judgments abiout 
service payment and claimtf, or in any non-medical social and governmental programs,- 



^ the individual should have an absolute right t<5 inspect what is to be released from 
his/her 'record. In chronic and acute care, patients should also have a right to see 
any part of the medical record, including the medical professional's working notes, 
if the patient insists upon this af'ter* the medical professional has had a chance to 
explain "directly to the patient why he or she feels that such disclosure would not be 
in the patient's best medical interest. A special procedure is suggested for patient- 
access problems in'psychialfric care. 

6. Managers of healt^f data systems must take steps to see that ,personal records 

'are as accurate, timely, hid complete as the uses to which they, are being put require 
for protection of indivi$|}|al rights. 
^* ^ 7. Data security measures .must be taken to control access according to the 
policies set by law or by management, and the adequacy of those measures will 
be -measured by the previous history of threats to data confidentiality fei that type 
of orgajiization.. . | . * 

8. Health data systems should conduct special orientation and trailing programs 
to inculcate respect for'c^tizen rights,, among their staffs and to deal with problems 
that may airise. / 

9. Each health data system should j pre pare and distribute a patient*s rights 
handbook, and install a readily-available and independent patient, rights representative 
in the organization. 

10. ■ Because new issues are posed whenever health data systems adopt new file 
applications, there should be provision for periodic independ|nt review of each 
system. - 3^ ' 

11. Special efforts should be made so that confidentiality rules do not interfere 
with the public's right to know what is being done by government agencies or by private 
recipients of government funds, and .to carry out critical oversight functions in the 

' ■ pubiic interest. ^ 

12. The importance of health-caire evaluation and. medical research calls for 
developing spreqial procedures so that these activities can be carried on without 
jeopairdizing citizen rights. 

^Recognizing that the job of refining ahd applying these princi^ples is a long-range 
- task, the report notes ^ome areas of priority for current action. ' On the legislative 
front, the^e include activities such as removing the exclusion of medical information 
from consumer rights under the Federal Fair Credit Reporting Acti adopting new state 
niedical confidentiality lafus and medical-research privilege statutes; supporting 
enactment of /air., information practices la^ws in tl>e ^5 states that do not have these; 
and writing more explicit citizen rights guarantees than have yet been included in the 
. major pending bills to create national health insurance. . On the judicial front, the 
report recommends development of a legal duty by health organizations to manage, their 
data systefns according to stanSkrds of reasonable pste, evolved by judicial definition 
in test cases. For " organizations operating health data systems, the report urges a 
full-scale "privacy audit." It also urges sustained activity by public interest groups, 
noting particularly the critical role played during the past few years by the American 
Civil Liberties Union, and the important potentiality in the newly-formed National 
Commission on Cor}f identiality of and Access to Health Car^ Records. 
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The report concludes with this comments ^ ' ' 

"It is the custom of Americans to believe that no 'lady-or-the-tiger • choice 
•has to be made between science and liberty. For 200 years, in* the tradition^ of 
Franklin and Jefferson, we have hammered out legal rule^ that allowed each 
successive wave of invention to realize its potential, but also recjuired each to be 
brought^ under the rule of law. Sometimes it took a whilS for the principles of 
regulation "^to become clear, and we have come to realize tijat the .awBsome Effects 
of contemporary technology give us less lead time for social leai^ning and regulatory 
response than we' had in earlier eras. « But that is the chaJlenge we face, and <t here - 
are promising signs that our society understands how important 'it is to develop, $oon 
the standards by which we can pursue the benefits of both science and liberty 'in the 
field of health care." * , 
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ABSTRACT 



report -investigates the impAcr-Q-f computers on citizen rights in the health 
Inr?l*^;f^?S72^ area Under Dr. lian F. Westin's 4irection. frfm July of to 
tf,h^■ ^ ^""^4 mterdisci^inary team did the foUowing- (1) examined 

published literature from medicine\and health, law. computing and social science- 

& Li "If £^^^^^^^ 

Part nnf Of this investigation werX then combined int/this four-part riport 
org-Sa rT^^-dLTiJ^d^^ 

derrltic'nations 'Ind'S.^'lp' re^ordsTpresents comparKonI Sth's^^other 
dl?a «v^^pm= ?Kf ' recommended management principles for "health care 

w^t^h s^;port-do^S:.^?riSd1^LrSat1^;;^ ^ ^^V^^^ bibliography Ld twelve appendf^L 



Key Words:, fjtizen rights; coniputers; conf identi\lity ; data systems; health r'ecords; 
information g.olicy; management principles;, medical records ;.' privacv • 
record-keeping practices; securitV. ^ • h ^. » . 



/ 



XX i 




" " INTRODUCTION 
* Background and Otdectives " . ^ - " • 

In considering which major field of record keeping about individuals to use^^as 
the subject. for our p-ilot study, we had little frouble in sel«c*lng health-care as " 
an ideal candidate. Sidce- every person undergoes medical treatment from inficy 
to 4eathj-iiealth-care is a- universal experience. Since the, use of health-care 
data \ffeQts everyone's rights, "benefits, an^ opportunities in the larger" society , 
this pijesenfs all the subtle^d difficult problems of how to regulate secondary 
uses ofVpersonal information, though there had been some valuable writing about 
medical data '-and privacy by 1974, when this project bega^, -the. field had not been 
as extehsiv^ry stiidi4d and publiply discussed as jnany others, lich as law enforce- 

•.ment or •credl^; reporting. -Finally, there was reason to believe^ that the potential 
exis1;ed for developing consensus among medical professionals,, poiiqy-makers, and 
public interest^groups as to the emerging civil libertiei problems djj health-data 

, syfetems and the range of alternative policies that could deal efJectively with 
those dangers, 

TV'us we chose health care. Ve did so with an awareness that the field was in 
a sta.o of major change in three basic dimensions: th# goals and organization of 
the nation's health delivery system; the application of computer technology in ' 
medical services' and health-data 'reviews; and the status of the individual's right 
to °<"itiy- the uses made of his or her personal health' data. 

L./^at our health care system is moving toward a fundamental reorganization 
needs.little documentation. The 'soaring costs of health , care , the uneven, and 
.^storted distribution of services, and rising public expectitions as to health 
care have carried ^s to the brink of enacting national health insurance. Such a 
_^iiew Method of financing American health car6 for most citizens will increase the 
federal role in paying for and in assuring the quality of -medical care; will foster 
new^ insurance and organizational nrechanisms providing supplements to the federal 
miniiimm system; and wiJ,?, lead to basic reconsideration of, the ways in which health ■ 
care is conceived, organized, delivered, evaluated, and publicly regarded.' 
Wholly apart from national health insurance, leading voicesXln the health fie-ld 
have called f(^r reshaping health institutions, linking environmental controls more 
closely to preventive health, experimenting with^new foms of health screening, 
arid launching far more comprehensive research into health matters than has been 
traditional in our society. More changes are expected during the" n?xt decade in 
our health care system than iije have seen s'inee World War II, or even longer. 

2. Computer applications in health care are expected to undergo a similarly 
major shift. The new financing and payments mechanisms under 'national health 
insurance will explode claims processing, and the requirements of quality-rcare 
review already under Professional Standards Review organization (P.sro) '^or Medicare 
wllladd tremendously to the transactional flows. These two developments alon^ account 
for-l;he judgment of mast computer forecasters^ that the area 'of health-care 
comp-u^ is about tc\ undergo the kind of expLsion tha> marked data processing, ' 
bankin^Seif'law enforcement in the '.past decade. 

Many experts believe that the next decade will see major advances in a host 
of_ application areas in health care that have been slow in unfolding so far — 
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hospital information syatems, regional health data systems, special health registers 
for problem areas, lifetime' personal medical histories, and many others ♦ The 
'.citizen in 1980 or 1985, it is predictedr, will feiel the pr.esence of computers , 
continually throughout his or her healtfi-care contacts, from the terminal that will 
take ^medical history in the doctor *s office or clinic to the on-line medical 
history that will be available whenever or wherever health catastrophes occur to 
a ^person, or t^o the machines that will. Star- Trek style, monitor vital signs and 
changes ^s patients lie in hospital beds. 

3» Finally, as we noied in the Preface, the United States is now entering a* 
period of new legal regulations and organizational policies as to personal priva^ij::^ 
The Federal Privacy Act of 1974 was a fundamental br'jakthrough, r^resenting 
Congress' finding that ug^c>i^fi9i^t2uida,rds should be installed to protect citizens 
from misuse of personal data by federal agencies. A Privacy Protection Study 
Commisaion created by the 1974 Act has been charged by Congress with the duty of 
conducting a broad two-year study of privacy and record-^k^eping in state arid local 
government and among private 'organizations , ^with a long list of particularly 
sensitive areas to be explored, one of. which is the medical field, \ 

^ Where medical' records are^ involved I serious q'^estions have been raised before 
the public, >n the pbst-Watergate setting, as .to how conf i^entialitj^ can be 
assured in a national health insurance system, as well as what is happening already 
to the confidentiality of personal medical data as computerized data, collection and 



exchange has spread in the health care environment. Another aspect ipf citizen 
rights in health care — the right of patients to see-fthe medical records assembled 
on them — is becoming a well-articulated demand of various con^umer4oriented find 
, civil liberties groups, paralleling the "right-^f-access" issue in malny other ' 
infonuation ^stems. * " 1 >^i 

.Predictably, there are divergent views among observers as to the mature and 
extensiveness of threats to privacy in various new health care programp, and in^he 
growth of automated data sys-tems. But there is widespread agreement- tnat dealing 
wisely and effectively with the jrivacy , "issue" is a vital matter, not 1 only to the 
public's confidence In new health care institutions in the coming decad^ but also 
to' the protection of fundamental citizen rights; * ^ 

The time, is ripe, tfierefore, for focusing expert and public attention on these 
issues, bfeore changes in health clare finsincir^ and review are enacted, before the 
new ^ wave of computer applications an^ information systems unfold., and before 
Arrangements to incorporate national patient identifiers and file-linking arrange- 
ments in the health field are put into place. Helping to ^sharpen that focus,' 
through an inter-disciplinary research effort and preparation^^^of an agenda of 
policy alternatives for the next decade, is the objecti^^^of this report. 

^ iBlisic' As^iSiptiohs / " ' "^-^ 

rfe "began o\xt analysis of computer impact in the health- care area witlj some* 
guiding assumptions derived from the National Academy of Sciences * 3tuay of computers, 
and privacy in 1969-1972. {That study had included health-care oj5ganizations among 
its 15-20 .major areas of personal record-keeping in Ajpaerican society^^ w4?^th aite 
visits that covered hospitals , "health insurance^ companies , local and state .govern- 
ment' health agencies, employee meglical departments maintained by private employers 
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and govermtnt agencies, and medical ^services in schools an'd universities). We 
^garded thfe findings of the HAS report as general probabilities, subject- to 
Verification or alteration on the basis o:;^our detailed researches into health-care 
Automation, in 1974-75/ The NAS findings we considered particularly relevant to our 
project wefre these; * , . " 

/ A. Triat computerization of personal data in the great majority'of organiza.tions 
^carries forward whatever legal rules, social -nornft , and organizational policies ag ' 
to citizWn rigiits (for better or for worse) that prevailed "in each type of 
organizational activity in its manual-redord milieu. "That is, computerization aS * 
such_^has^ not led to either "stronger" or "weaker" policies with regard to citizen 
rights. / Unless such forces as newllaws, public' protests , or pressures from within 
by professional workers, intervened to influence orfeanizatipnal mana«emen'ts , 
_ automated systems adopted existing policies as to what information was collected, 
how it /was used within the 'organization, with what outsiders the data was shared, 
^ whit provisions were made for access and review by. the individual. 

B. How4^er, oomputerizat,Lon spread through the world of organizational record- 
keying Wng a period of drastic change in American values and social allocations. 
In the H^st decade, groups -fomerly discriminated against m the awarding of 
sociel^'s benefits 'and opportunities have" Remanded and won recognition of their 
right \o equal treatment. Essentially, this mVans that the collection of personal 
.data government agencies oi private organAa^lSns on matters gf religion, race, 
'sex, ^political activity, cultural style,, or sexual preference 'is "no longer 
considered legitimate Uple^s it can be shown that such. data are ^ot being used by 
• such organisations to make discriminatory judgments. Moreover, the record systems 
otmost l^ge organizations still^ontain a great de&l o^^Sub jectiVe and judg- 
mental d^ta about^iviRiuals. collected in the "earlier era"; unless systematic 
pursin^/of such data undertaken in -bothj manual and automated files, there are 
serim^ riska that individuals will continue to hav« judgments made about them on 
thySasis of improper information. Furthermore, the public 'had registered in the 
•1%0's its clear dissatisfaction with the creation of secret data systems about 
citizens, whether by police or commercial reporting agencies, as well as the 
ffiaking of evaluative decisions' about individuals in reliance* on 'records that the 
individual -did not;,have an opportunity to inspect, .with procedures f^r correction 
should there be inaccurate, incomplete, or misleading information in them. 

C. The NAS study found that computer use had not resulted by 1972 in the 
merger of all files within an' organization or at a level of government in the 
kind df "one-.big-databank" ap^oach that was advocated by some computer . 
enthusiasts in the late 1960's ^aAd early 70's,.and which Ivad been properly viewed " 
with alarm by social commentators awarp of how little law was then available to 
control -such greatly enhanced data systems, if they did come into existence. 

D. She NA& study found that automation seemed to be creating certain effects, 
that did deserve close attention". In most organizations, computerization was 
leading to faster transmission of data and faster decision-making; more complete 
and uI>-to-date records on persons; gree^ter "massage" of personal data once it was 
collected; the creation of some large centrally-directed" regional or national data 
networks;, and the creation df some large personal' data systems that would probably^ 
have been too costly or cwbersome to have been initiated under manual procedures .~ 

ic . . . • C 



None of these 'effects were seen by the NAS study to be Automatically bad for civil 
liberties, but they enhance the eff iciency] c5f governmental and private 'organiza- 
tions in the use 'of personal data at a time of high public distrust of government 
and private institutions, especially for their intrusion into zones of personal and 
group privacy. This made even more imperative the es/Tablishment of clear 
public policies to control the automated data systems that would be steadily 
expanding, and^ growing far more sophisticated, in the late 1970 's and 80*s. 

E. The NAS' study concluded that in'the mid-1970's, most controversial 'issues 
of citizen rights in record-systems would still involve manual records rather than 
the automated systems. 'This was essential!/ because the more' narrative and 
subjective records. in each type of organi'zatidrf, which usually involved the most 
critical civil liberties issues, had not yet been automated. Thus when citizen 
rights questions' wer^ addressed, the 1^3 study concluded that the first priority * 
was to re-examine data policies without reigard to whether theL^storage and processing 
medium was manual or automated. Once proper rules had been set, policy-makers ' 
should "then address what special safeguards and procedures were necesjsary f6r 
automated files, and set these into place as general system requirements. 

Me thodoloAY - " , ' . j 

followed the general ipethodology used by the National Academy o.f Sciences' 
Project on Computer Databanks.* As applied to the health care field, this 
entailed four steps: " ^ 

1 Documentitig the patterns of record-keeping about people -that. prevailed in 
the health care field before aiutomation arrived including 'the realities of 
organizational Behavior and the civil liberties rules that were applied in that 
milieu. • - ^ , 

Describing the reasons' why health care organizations have^ moved to adopt 
computer technology, tracing the changing patterns of computer applications down 
to the present, and presenting concrete case studies of organizations that have 
'undergohe these developments, including thei;: handling of citizen rights issues. 

3. -Identifying the effects of computerization on the status of citizen 
rights in the health area, including in this estimate, an ana^y^is.of changing 
social norms, public expectations, and legal conceptions*^^ these ^rights .during 
the highly dynamic period of the past decade. " . ' ^ 

4. Posing the policy alternatives that face American society in .this 
field if new standards and procedures are t^ be adopted, by organizational 
initiative and/or 'publib regulation, to assure th^ vitaJ^ifEy of citizen rights 
guarantees in the increasingly computerized ethos of health care record keeping. 

Ve have also employed the basic research techniques of the National Academy 
of Sciences* study. Following a thorough inspection of the published writings on . 
our topics in the literature of health-care, law, computers, and social sciences, wV* 
h^ld briefing Sessions with three major computer manufacturers (UNIVAC, I.B.M., and 
Honeywe!Ll) to discuss computer applications in health care. We then made site 
visits to six organizations whose experiences would provide insist into the way ' 



* Alan F. Westin and Michael A. Baker, Databanks in a Prea Society (N. Y. 
Quadrangle, 1972).. . ^ ' ' 
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computerization and citizen rights developments were taiciriig place in the real 
world; these site visits were written up as case studies and appear in Part III /' 
« of this Report. ^ ^ ^ • * • . / 

For general background, we* contacted about 70 organizations- in the health 
qare field, soliciting any policy statements, research studies , or other material/ 
that they had on the issues o€ confidentiality an^ computerization, Ve also 
' conducted a aurvey of the national and state affiliate offices of the American 
Civil Liberties Union, to obtain instzuices of complaints about violations of 
confidentiality or refusals of patient access to records. Similar inquiries were 
made of public-interest law firms, consumer .organizations, minority rights groups, 
and regulatory agencies, Another technique that we used was to devise a form 
soliciting reports of violations of citizen rights in the use 6f personal medical 
a^ta, in either manual or computerized settings; we distributed this form at 
severalj;iational m^i^ings of 'health care organizations during i974-75,* . 

For comparisons with trends in computer use and citizjan rights protections in 
the health care systems of other democratic nations we. corresponded with medical, 
. societies, government experts, lawyers groups, and civil liberties organizations . 
in about a dozren nations' We also haS contacts with t\ie Computer Utiliz:^tion 
♦Group of the O^E.C.D. in Paris, through its director, Dr.^Hans Gassm^mn; The • . 
patttrns of experienc%^ in a group of selected nations appears in Chapter 12 of the IJy^ 
Report. * ' ^ ^^^y^ ^ -.^^ 

- We regarded a careful review of the firK di*af t of this report by a group of ^ 
experts representing the fnterested parties in healtn care and citizen rights to be ^ 
a. vital part of the project methodology. ^3?hi^|^was not only for the usual purpbse^of 
obtaining corrections of fact and ^reactions spe<^fic judgments and recommendations, 
but also to test the range of ^greemeht as to problems and solutions among medica;L ^ ' [ 
specialists, government health officials, lawyers, ciy^l liberties ^oujis , computer 
experts, 'abd similarly important participants in , the standards-setting process. 

This wac done in two parts. On September 16-17, 1975, a review conference of 
35 participants; under the chairmanship of Dr. Vernon Wilson,--' was helel at the 
^National Bureau of Standards, in aaithersburg> Maryland. Copies of the report were 
""^Ipo^ sent out for written coinments' i;o a group'-&t,about^ 50 additional 'specialists. 
(A list of these reviewers is contained as an Appendix, and we are very grateful , ^ 
to them for havj^ig made such a useful cbntributior> to the pi^ject.) We found that ' ' 
there was, indeed, a* very large area of agreem^ent among these reviewers, on hpw to 
approaci\ the issues in the field, and we discuss thl^s situation, in the final chapter. 

Following the reviews , ^the report "was completely revised b^^.the Director and 
IW. Florence Isb^ll, during the period from September, 1975 to March, 1976. 
Definitions ' . ' » • ^ 

. A last few introductory words are in order to define three terms used in this, 
report to represent the main civil' liberties interests ojj^the citizen in personal ' 
records. ■ > , . 

^ • * ' % 

♦See 'Appendix i for lists of . organizations- contacted , sample forms, etc. ^ 
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X. Privacy i? the question of what pers'onal infoy-mation. should .be collected or 
stored at all for a^^^ven^^so'cial function. It involves issues as to tlie legitimacy 
and legality of orga^zational demands for disclosure from individuals and groups,, 
and tike* setting of balances between the individual's control over the disclosure ' 
of personal inf ormalrion and the needs of society for the data on 'which^W base 
aecisdons about individual situations and to formulate public policlea, 

2» Confidentiality is the question of how personal data collected for approved 
social purposes shall be held eind used by the orgeinization that originally collected 
it, what other secondary or farther uses may Be made of it,\and when consent by the 
individual will be required for such" uses. It is to further the patient's willing 
disclosure of cpnfidential information to doctors (that the law of privilegea 
^ communi cations developed. In this perspective, security of data involve"^ ^ui 
orgenization's ability to keep its promises of confidentiality. 

Individual access is the ^issue of when individuals should know that a reqdrd 
has been crated about them, and when they can examine it in* order to check its' 
accuracy, completeness, and the uses being made of it. Fundamentally, the claim 
to access rests 6n the due process of law guarantees of the American legstl system,* 

^ The^ are other citizen rights issues in^the field of "health care that we do 
fio^t cover here, basically because they are not record-keeping. problems and are not* 
being affected sigrfif icantly by changes in information-handling technology. These 
include the individual's right to treatment, informed consent for medical experimen- 
tation, the Vight to elect de'ath, .and similar important q^ues'tions, " ^ ' 

. Finally, we will use both the terms medicgtl records and health data in our 
discussions. By medical records, we mean the formal i*eCord of a pafient*^ reception 
tredltment, and progress in primary care settings, usually taken by various health 
professionals; this will include any, personal, family, or social histories 
acquired for patient-care purposes. We use health data to vdescribe any information 
about a person's physical or mental health, 'whether originating in a- medical 
record or other source, that^is used to make a judgment about an individual's 
rights, benefits, and o^)portunities in situations other than direct hea].th care. 
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INTRODUCTION . , ^ 

To measure the. impact of new computer airid communication technologies on Kealth 
records and ci'tizen rights, we n^ed a set of baselines. In this case, we need 
three baselines i ^ . 

1. How were medical records and health data collected, -processed,* used, and 
circulated in American society at the moment - basically the past decade - when 
automation fir^t began to spread through the health caire' field? 

2. What were the rules of law ani definitions of citizen rights that were applied 
to such traditional patterns of medical record keeping, both in theory and in 
practice?. ^ 

3. What kinds qf disputes over medical data and* civil liberties ^claims were 
.already arising when computerization arrived? 

Presenting si|ch baselines is not a simple task. There- is no work iit existence 
that describes comprehensively how medfical data aire generated and used in American 
.society. Nor is the average citizen, or even the average medical professional 
or legal expert, awaire of how widely the individual's medical and health data now . 
*circulate from doctors' offices, clinics, and hospitals to the files of insurance 
companies, health caire review committees, employers, educational institutions, 
the military y ^the police, credit bureaus, government licensing agencies, research 
studies and siirveys, and a host of other users* Lading out s^ch a map of medical 
data uses and the citizen rights issues that have been generated by them is 
therefore our first goal and the topic of the^next three chapters. 

To most people,* "mediclL^b^ecord** probably evokes a picture of a folder in a 
doctor's office or a chart on a clip-boaird iti a hospital. Our common expectation 
when we tvisit the doctor is that we will be asked many questions — about childhood 
d'iseases and current, problems , about the health of our parents and siblings, about 
our age and weight, .about what we eat and how much we smoke and drink. Then we 
will be poked, tapped, f inger-ppicked and examined, and the resjalts of all these 
*probings - mental and physical - will be entered into the folderT 

Throughout this process, the patient is usually a willing " pair tici pan t . The 
doctor needs to know,* and the patient accepts that need as a vital ingredient .of 
receivir^ good medical caire. The patient' has the same general expectations of. 
hospital caire', although a lot more people there need to kr^ow— nurses and 
pathologists, surgeons and aiftsthesiologists , and the admitting clerk who may 
insist on knowirfe the mother's maiden name before it will be permitted that the 
baby be born or the operation performed. But the' probing is accepted here , too, 
as part of the bairgain th^ patienT strikes t personad information in exchange for 
medical care. \ ' ' ^ ' \ ^ ^ 

If reminded, the patient will also ijacall that those who pay his^ medlcajl - 
bills — ^whether government agencies or private companies — need to know why the 
patienlTjJas in the hospital, and for 'how long. But the average patient could 



ERIC 



probably not say with any certainty what other information about him or her 'is 
given to insurance -payers'. 

t 

Beyond this direct experience, however, the concept of medical records is 
likely "to be blurred for .most patients. They have made no explicit bargain that ' 
^ their medical records will be shared with employers, or welfare agencies', or 
licensing bureaus, or government departments,- or a host of other non-medical 
agencies. If the bargain is an implicit one. often the patient is an unwitting 
PEUrticipant in the transaction. 

Part I <)|f-thi8 study will trace the course of .medical ££W)rds, beginning witK 
the patient's' direct encounter with medical care, it will examine who keeps medical 
records, how they are kept and why they are kept. The various kinds and uses of 
medical records are divided into three zones', described below. ■ As with any such 
arbitrary sy;^tem, some of the items in -each of the three zones defy neat labelling, ^ 
many of them o^l^lapj some are discussed from several points of view. Thus, for 
example, medical J^ords in la# ;enf orcement is discussed ilTzone I as part of a 
physician's duty tc report certain conditions to the police, ind agaii^'in Zone III 
to describe how la» .enforcement agencies use medical records.' It is hoped that 
tM sense of deja-^u will be kept to a minimum, and that where repetition is 
unavoi,dable, the r* ader will be forbearing. 

' , * 

zSneJ^ - Primary Health Care This chapter will describe medical records that are 
. created when a patient seeks health care from a health professional-whether a 
personal physician, a hospital, a' health center or clinic,, a college infirmary, a 
company doctor, ete.-_I.t^^--here--tha*--t he oy^le of ^medical redord-keeping usually 
begins. And it is. here that sensitive ethical and lefeal questions as to . 
confidentiality aftd disclosure sometimes pit tte medical. prof ess ion's 
perceptions of good medical care -against the rising consciousness of some patients 
and consumer groups who Seek greater., participation in medic^f diclsionwmaking. 

Service Payers and Health Care Reviewers This chapter will examine the 
use of -medical records b^ those who pay for medical care-both private insurance 
companies and. governmervt progr-fpns such as Medicare and Medicaid. ' It also surveys 
voluntary private groups and government -agencies thafrevi'ew individual medical 
^ records as part of their efforts to analyze the quality of, medical care and to 
determine whether hospitals and other health providers are in fact delivering the 
health oare for which 'they are being reimburs.9d. . it ia especially important to 
understand the current practices in Zone II. f or ^hese two functions -paying for 
health care and monitoring its quality-prlf igure ^he creation of a universal, ' 
pre-paid health insurance program* r ... 

^" - SecondaCY Users 5f Personal Medicai D»t« "^This chapter will discuss the 
,use of medical records in the non-medical world. Prom' ."womb to tomb." - or to put 
it in medical record terms - ft-om birth certificate to death certificate, medical ' 
records are required, among other things, when starting school, going into 'the 
armed forcfes, getting married, travelling kbroad, getting a job or a bSiness ' 
/ , •• 
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license, driving a car, applying for life insurance, receiving g^ernment benefits, 
applying for a security, tjlearance , encountering the law, or going on welfare. It 
is here that breaches of confidentiality and inaccura,ciQ,s in records can exact 
a painful human toll. ' " *. 

The chart below diagrams the flow of information jii^ti <,de^pa2dFbed-; — ^he*1?);ree 
chapters that follow use the items listed in each. Zone as chapter sub-heads. 
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Part One draws^ on memoranda by projebc consultants Michael A. Baker' 
^("Gene^'al Patterns /of Re cord, Keeping About People in the Health Care Field- The 
, Pr^bm^,W Bas^linei^^ and George,J, Anna? :cyudiiial Treatment of Medical Records 
and ConfidentJ^ality"). TheSe^were produced for the first draft of &his report". 
• and are on file with the Institute f or Compu'ter Sciences and Technology. National 
Bureau of Standards Washington. D.C. -20234. 
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CHAPTER 1. ZONE I - PRIMARY HEALTH CARiS 

What follows is a description of record-keeping in the private practitioner's 
office, and then a description of the process in hospitals and other healthy 
centers* Re cord -keeping in which, institutions employ health professionals to 
- j;^|jreat- their special populations (e,g*. ^ schools, armed forces, prisons) is handled 
^eparateO^ since the existence of ^^'physician-j.nstit\itional relationship 
alongside the physician-patierit ♦on^^pcQ^ides a significantly different setting 
, for viewing ethica^l and legal problems • 

Record Keeping in Physician's Offices * 

An estimated 80^ of health care is,' delivered by more than 190,000 private 
practitioners in their offices, with oyer 900 million patient visits to physicians' 
offices in 1973.^ The most important 'xise. of the patient •s^^medical record here 
is as an aid in diagnosis and treatment, w^ith the private physidsm free to cnoose 
whatever form of record-keeping he/she wishes. The broad^ vairiety of record-keeping 
practices to be found in private offices reflects differing medical philosophies ^ 

r 

as well as the demai^s of different kinds of medical practice. 

Some physicians use their -office records only to jog their memories about the 

social and medical characteristics of patients; they provide care for the most part 

on the basis of the patients' verbal reports of symptoms gtnd their own most recent 

\ * 2 , . . 

.tests and oDservations . 

> 

Some physicians, specialists for instance, see thousands of different patients 
a yearr their record of each patient is likely to be very (^tailed as to diagnosis 
,and treatment, but nairrowly focussed on the specific problems referred to them. 
Participation in group practice also affects the character of a physician's records 
since there is apt to be greater demsind for communication from other physicisins in 
the group responsible for the patient's care. 

Psychiatrists, psychologists and psychotherapists in private practice vary 
widely in the amount of {detail they record on their patierfts. Psychiatrists are 
MDs, antt they often keep records of their patients' j/hysi'^al ailments, especially 
where psychosomatic problems are being tt'euted. Som^ the^a^ists tape-record their 
sessions; others keep but a few notes in a short-hand only 'ft hey pan decipher. 
Professor Ralph. Slovenko notes' that "It is customary to keep records of 
appointments and billings, but most psy'cl^oanalysts and analytically-oriented 
psychotherapists make no records or notes of patient* communications • ,^0f those 
who do, many store such recorci^ under code names or numbers* 

\^ . Beyond the physician*s per^p^(^ti^^cKoic§ of record-keeping .methods, there are 
Nseveral other factor^that influencij'thes.e activitiest 

1. Third-party payers More tAan 150 million people sire protected by 
ir medical expense insuranceT^P^ch provides benefits toward phjrsicians' fees 
for noJvsurgical care given In the hospital, hom$ or 'doctor's office. The 
information that doctors' must submit to insurance companies to justify payment for 



^ Raised fi ^ - ra i ndicate the footnotes located at the end of the chapter. 



12 



ERIC 



33 



such office visits frequently requires making additional ^ntries into .the patient's 
record. , , . . 

■2' P^^blic Reporting Reouirementa state statutes require a .broad variety^ of 
reporting by physicians to 'apprbpr'iate government agencies. Among these are • * 
communicable diseases such as TB. venereal disease, meningitis. 'polio, etc, wounds 
deliberately inflicted with a deadly weapon, child abuse and neglect, all deaths 
that are not; "natural", as, by llrowning, from_ falls, or sudden deaths', and 
industrial accid.ents. In' addition, physicians must keep a record of their 
prescriptions: for narcotics and other dangerous drugs in. a special register which-^ 
•is open for inspection by federal and state authorities . 

, It .is difficult to tell how strictly these reporting statutes are enforced..- I 
a study of 237 private physicians conducted by Consultant Magazine in 1972, it was 
found that -while 60% of those responding felt that venefeal disease reporting ■ 
should be comp,ulsory, in fact only 11% of the physicians reported gonorrhea and 
only 20% reported syphilis. 

■ . y ' 



3. Malpractice claims About 60^.of tjie malpractice claims made in 1970 were 
against l>hysicians in private practice. ^ .There has been much professional discuesi 
of the sharp dncfease in malpraajice suits, and physicians are increasingly -^aware 
that their office records are a prime source of information about the Quality of 
their care. As^g result, physicians, like hospitals, "are increasingly engaging in . 
"defensive medicine," that is, the ordering of tests^and consultations so that the 
record will show the, physician took every reasonable precaution; While it is ' 
difficult to estimate the amount of 'defensive medidine that tk^s place, some - 
authorities claim that it has at least one beneficial effect, ^th^ overhanging ^ 
€fafe_at^f litigation does seem to encourage ♦more methodical record-keeping. - 

Hospital Record Keeping ^ ^ ' ^' , , ' 

Thirty million patients are admitted each year to the 900 proprietary, 3 500 
voluntary and 2,700 governmental^ hospitals which offer care for acute conditions ^■ 
-The medical records of these patients may include, identifying information, x-rays, 
EKG .and lab test results, daily observations by riurses, physical examination 
results, diagnoses-, drug and treatment ord'ers, progress notes and post-operative 
reports from physicians, medical history-secored from the patientT^^ent forms 
authorizing treatment or the release of information, summaries from the medical 
records of other institutions, and copies of forms- shared with outside institutions 
for -maarance purposes. In some cases, ad hoc staff, comments a^-out the patient's 
character or de,meanoi^are also put in the record.^ 4 

% ° ' ^ *■ ■ 

Hospital medical records vary considerably, so it is difficult to describe 
the "typical" record. In some institutions, one coGld find all of the above 
information in the patient's medical "jacket" or central file, and this could total 
80 or 100 or even 150 pages. In others, only the patient's current condition is 
described in the medical record, but other information is developed in the fiXes 
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of the collection department or the social service department. 
^ . ^ . Cf ^ 

In most hospitals, each of seueral deparftments—pharmacy , social service, 
billing— maintains .its ovm fi^es, duplicating' most of the information stored in 
the patient's centra^l record. Often the lihes between social service, medical 
and administrative records are blurred. The "medical" record may contain 
information about the patient's insurance j the so^al service file will certainly 
cpntain some reference to the patient ''s^medical conc^itionj identification files 
or the daily *bed 'census reports ind'icate the waird xo which the patient was admitted, 
such as obstetrics or psychiatry . The patient's hospital record, then, is 
really several different overlapping files, often kept in separate places. 

In. many hospitals, there aire central medical records handled by medical record 
administrators, a pairamedical profession developed over the last fifty yeairs along 
with the increase in size of general hospitals and the specialization o% «the staff 
within them. More than 11,0,00 medical record administrators and technicians now 
work full time at supervising th€% filing of medical records, enforcing hospital^ 
rules about their content and accuracy, and extracting information from them for 
insurance and other purpo&es. About 25^ of these persons aure certified by the 
American Medical Record Association.^^ 

Problems of patient identification ajid record retrieval are chronic in many 
hospitals. Some hospitals use a "serial" numbering system in which a new number is 
assigned to the patient at the beginning pf each hospital stay. If the patSent^ 
returns to the hospital » he or she has to be matched accurately with pagt records 
or these cannot be used. A related problem is that the information in the patient's 
record is often poorly organized. A typical complaint from physicians is that 
needed information from a thick patient file cannot be easily extracted. .As a 

result, even when the patient's past file can be retrieved, the information 

12 • ' 

recorded in it is often not used. ' ^ 

Unlike the private practitioner's records, hospital records are sub jec^^^'.'both 
internal and outside review. Where federal money is disbursed for health care, such 
as in Medicaid or Medicare, federal regulations require the establishment* of 
Professional Standairds Re^view Organizations (PSRO) to determine that facilities sSid 
professional services are not being misused. Medical records play a central rx>le 
in such utilization reviews. ^-^ ' . * 

r 

The Joint Commission x>n Hospital Accreditation, a private organization that 
sets standairds for hospital accreditation requires that standard nomenclature be 
uqed in diagnoses and that recor^ds contain "...sufficient information to justify the 
diagnosis and warrant the treatment and end results.** When the accreditation 
surveyor reviews hospital facilities and procedures, a considerable part of his or 
her time is spent on patient records. 
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Local and state agencies also conduct hospital reviews. Recently » the Kew Y«ork 
^ City Health Department condemned three voluntary hospitals participating in the 
.Ghetto Pfedicine Program tor failing \^o maintain Mrug "reaction" files necessary to 
^ prevent a pratient from b/ing injured by a bad combination of medi^cation or by drugs* 
' 'to which he or she had had an kdverse reaction in the past.^^ 

' But poor public hospitalb^e not the only ones with record-keeping problems. 
For many hospitals, the Joiaf Commission's criteria. are never entirely^ achieved. 
Among the* facts of everyday life in hospitals are physicians' tardiness in signing 
^^^^^rug .orders and completing discharge summ^ies, and hospitals that ignore some 
record-keeping requirements because of lack of staff and 'mounting costs. 

In short, hospitals tend to ailocate\heir limited resources to record-keeping 
tasks^that meet immediate needs i to provide minimum information for patient care? 
^to file insurance claims quickly so that the hospital gets reimbursed; to respond * 
to an ultimatum from the Joint Commission on Accreditation that pBrticular record- « 
keeping deficiencies will no-longer be tolerated • / 

■ _ ■ • - ^ ^ , . 

. Like private practitioner's records, hospital records are used for insurance,^ 
•both pl-ivate aJid governnieotal, and as protection against malpractice claims, 
hospitals ar^ also subject to the same public reporting requirements as private 
physicians I -communicable disease, law#enf orcement. child abuse, narcotics 
prescriptions and death certificates . One widely used record is the birth" 
'certificate, and the duty to report births falls largely on hospitals. ' ' 
' ? , - 

r, ■ ^Birth records serve both research^and legal functions, and' for Ainericans, are ' 
the crosest-this country comes to an official identity cardt a birth certificate is 
usually required upon entering 'elementary school, getting a work permit or driver's 

'^cense, a passport, entering the armed forces and securing social security benefits, 
enforcement agencies also regard -bight ^birth certification procedures as 
important. The immigration and Naturalization Service, for example, uses the birth 

•registration sygtem as" one way to stem the flow of illegal aliens. 

The U.S. Standard ^Certificate of Live Birth contains spaces for the names and 
addresses of the .pai-ents, the child's name, the date, and the signatQres of a 
-: physician or other witness and the local registrar of records. This part of • the 
Birth Certificate is a -matter of public record in many .states .^^ 

•The form also includes information about the conditi(5n~oX the mother prior to ' 
chUdbir-^i, complications which developed during delivery, and congenital or other 
physical problems tfe dhild Was observed to havp at birth. There is also a space * 
for hospital personnel -to note whether or not the child is legitimate. It is not \ 
always clear how this decision is made. In an' informal investigation of this 
question, Prof;epsor KicJjael Baker's students found that sometimes it was made .by 
, doctors, sometimes by nurses. The patient was not always believed,, and the nursing 
staff woiild sometimes check "outi of wedlock" even wh^ she claimed, to be married. 
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But in large anonymous institutions where a woman may identify herself and the 
'\ father as she pleases,* an illegitimate birth may be recorded as legitimate. 

Psychiatric ^Hospital Records 

* The medical portion of general hospitsd records may contain data tl^ relates 
only ^to'the illnesses^being treated. But psychiatriq hospital records aire likely 
to be all-inclusive. As sociologists Kai Erikson and Daniel .Gilberton put itt 



••The presumption in -psychiatiric/f acilities. . . is that there are no 
areas in the patient's life (and for that matter, no aireas in the lives 
of his associates-), that lie beyond the legiti-mate jj.nterest of the . 

' institution. In this sense, the psyobiatric dossier is, not a brief 
inventory of selected information'! it Is a biography, a digest of one 

»p^son*s character and prospects..." 

Erikson and Gilberton go on to note that while the record is all-inclusive in 
one sense, it is highly s%lective in the sense that only those items that identify 
the patient as ^eing ill aire likely to be included. Thus, if the patient tells a 
psychiatrist of (a) his bedwetting, {b)^of his fear of a teacher,' (c) of enjoying 
f.amily picnics, {d\ of his impulse to hit his sister with a hammer, (e) of winning 
a slJelling bee, (f) his terrible drecuns, (^) his friendship with an unremarkable boy, 
(h) his parents '-iirguments, and (i) his exploits as a yo\mg athlete— items (a),' (b), 
(d>, (r) and» (h) will no doubt be noted' in his record j items (x), (eVv (g) and (i)^ 
will likely be omitted as irrelerv^t. ' ^ " / 

Msmy staff members may contribut^e 'to the patient's record — "physicians... 
psychologists, s^pcial workers, nurses, occujfational therapists, aidfes, ' clerks. .. •* 
•The*^ily- nursing notes may contain comments on the patient^s mood, fantasies, plans 
for the future, emotional outbursts, posture, and interaction with other patients 
£ind staff ♦ * , 

In s^ome psychiatric hospitals^ patient records are kept in two diff-erent 
ca'tegoriest material like case histories and certain test results are stor^ in 
the central record room or in a locked closet off the ward, while day-to-day 
operating f iles 'SUch as medication records, nureing notes and doc^t)^ orders are 
kept in the waird where the patient -is receiving treatment. The distribution of 
these records can be a 'delicate matter. On the one hand, tJje patient's privacy 
is^.best proteated by keeping sensitive materiatl off the ward, whe^e students, aides 

~ and even charwomen roam largely at will. On thfe other hand,* parti tit)ning of 
rec^ords has the obvious effect of drawing status lines through the hospital staff^ 
in a manner "that doejs not serve to improve tempers^ or the treatment offered the 
patient. Tfaere aire hospitals, for example, whiH^ nurses do not have access to 

'^the more sensitive rjeeords,, an'd are dependent on physicians forv^the mo^ basic 
information. , . ^ 
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The amount of detail in the nypical** patient record varies considerably^ainor 
psychiatric institutions, especially between those which provide ' active 'therapy and 
the many long-term institutions that, are largely, custodial. Erikson and Gilberton 
suggest that in either case, most of the material pladed in the file is not read by 
the people td whom it is addressed r when the records are stuffed with nursing reports/ 
and social work interviews, clinicians do not have sufficient time to reView them. 



Nuysing Home Records 

.The recent scandals involvinji nursing ^omes licensed by the State of New York 
revealed f inane ial^exploitati on of the inmates, abysmal physical conditions, * 
inadequate nutrition, and a denial of medical care to patients suffering from 
illnesses. One of the charges made was that patients' records were falsified to 
cbnceal stripping the patients of their financial resouces, and to create the 
impression th&t patients were receiving care that would make the owners of the 
homes eligible for state and federal reimbursements,^^ ^ ' 



In a study of a private nursing home in ^Washington , D.C., where the majority of 
patients were referred by St. Elizabeth's Hospital, it was discovered that patients 
were being forced to work fifty to sixty hours a week in. the home's kitchen and 
laundry, or were being hired out to.tieighborhood businesses for as little as $2,50 
a weekj that the records were falsified "to show that t^ey were not work'ingj or to 
show visits to doctors or hospitals that never took -place, or to show assignments to 
rooms of on^ or 'two inmates,, when ' in fact all the rooms were shared by four peopl-e 
* or more, ^ 

. . M — " ' . 

In 197^, HEW se^ new standards for nursing fiome care, including medical care, 
staff-patient* ratios, nutrition, minimum space per patient, etc.^^ The regulations 
include a Nursing Home Patients' statement of rights, and among the* rights 
guaranteed is "confidential treatment of (the patient's) personal and medical 
records" and the right to "approve or^refuse their release to any individual outside 
the facility excepts in case of his transfer to another health, care institution, or 
as required by law or third-party paymenf^contract. " 

The record-.kee.ping problems in many nursing homes do not usually Involve 
-breaches of confidentiality. The more frequent complaint is lack of supervision of 
the institution. The main emphasis of the new HEW regulations is setting standards 
for care and monitoring exploitation of the patients. * * * 
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Records in Other Health Care Settings 



Some public health clinics have. aS -complete information about a patient as the 
general hospital. Pre-natal clinics, for instance, may do a complete medical 
work-up. But more often the scope of the records reflects tjie^^limited medical care 
provided — vaccinations, treatment foi^, minor illnesses anji injuries, etc. Where 
V.D. treatment or birth control i^nformation is provided, the records generated, 
while similarly narrow in scope, may be extremely sensitive, > \ 



Dentists usually keep little information beyond a' history o^f the work performed 
and x-rays. These a^e sometimes used as identification JTbr disaster victims and in 
criminal cases. Dental surgeons maintain a greater range of patient data because 
they often administer anesthetics and prescribe medications,^^ 

Optometrists and podiatrists keep only the patient data relevant to their 

specific tasks r Local phsu:*macists can get a pretty clear picture of their 

customer's medical problems from the medications prescribed and the specialties of 

the physicians writing the prescriptions. In most pheurmacies, pre^scriptions ^are 

filed in sequence, eacj;^ under a differeajt number. By law, prescriptions for 

narcotics are filed sepeurately and the pharmacist must account for his supply of 
* 27 

nsLTcotics^ ^ In many states, the funeral director has access. to medical information 

* , ^ ♦ * 

because he is responsible for filling in identification information and getting the 

' •* ^28 ^ / ' • 

physician to record the cause of death, * - • ^ 



Citizen Rights^Issues and the 



1 . Privacy , « 

The information gathering process in a hospital is just one facto): but of many 
which tends to strip patients, both figuratively^ and literally, A patient is 
constantly being physically exposed during medical examinations, by the backless 
hospital gown-, by the performance of bodily functions in front of ward-mates and 
staff J by the invasion of the ward by other patients' visitors, gray ladies, clergy, 
administrative workers, nurses' aides, cleaning people and others' whose comings and 
goings the patient cannot control. Whether a pairticular hospital staff treats its 
patients with tact and sensitivity, or with iiidifference or callousness, the 
stripping away of the patient's reserve^ is a dominant theme of hospital life, Tha 
hospital staff may view this process matter-of-factlyj the 'patients may not, as the 
reraeirks of one patient illustrate: . 

X J*l saw what happened to one of my ..roommates ,, ,She had plastic surgery 
of the vagina and it seemed like eyery new nurse and everybjody on duty wanted 
to see,,, It seemed Tike just a* case of out-and-out curiosity ,She was 
feeling very sensitive and not heally wjanting to advertise the fact. And 
now everybody in the world is going to "^look , , , _ ' 1 * 

• A hospital, then, is not a place likely to ^pster an atmosphere of patient 
privacy, and the collection of intimate medical information must be seen in this 
context. ^ ' ' . ' " ^ ' 

18 • " ; ' 
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Within the hospital Jraw^work, it is almost universally accepted that full 
disclosure by the patient to the health care provider is necessary, often crucial 
for accurate diagnosis and effective treatment, and few objections are raised about 
the circulation of patient information among medical personnel directly involved in • 
patient care. 

However, two questions closely related to privacy sometimes do arise. That is, 
what should be Recorded and long 4t should be |:ept. One such case involved 
several San Francisco women jjrtTS' .sought to have hospitals return "psychiatric need" 
letters , written by their doctors to justify abortions. Before the 1972 Supreme ^ 
Court rulinfg that women have. a constitutional right to .an abortion, the only way 
they could secure them in- many states was to claim a psychiatric condition that 
♦would be exacerbated by pregnancy. Many doctors exaggerated, the emotional distress 
felt by a pregnant patient to justify an abortion in a particular state or for a 
particular hospital review committee. 

A San Francisco woman had secured two abortions at a ^a'iser-Permanente facility, 
one of whicfi had required an "emotional distress" letter. She, told the Kaiser 
authorities that she wanted it b^ck, with no copy kept^^by the hospital, because if 
she applied for life insurance, certain government jobs, licensing, etc., she woufd * 
.have to sign releases waiving confidentiality of her records and she could be harmed 
by the presence of 'that letter in her file.^^ 

Neither she nor any of the other women succeeded in getting the stigmatizing 
letters back. One hospital justified itself by citing a seven year retention-of- 
records law. Another said it had to. keep them in case of legal actions that might 
somehow involve the abortion procedure. Another said it would be willing tq destroy 
the letter but would not give the patient the original. As more and more permanent 
files are created, the question will arise yith increasing frequency: When can 
patients have records that are alleged to be- inaccurate, incomplete, biased or based 
on outmoded social or ethical standards expunged fr.om their files, and by what 
procedures? ' ^ ' 

2, Confidentiality ^ 
"The doctrine of confidentiality has its roots in earliest medic jLne. It was 
promulgated to reassure the' patient that the information volunteered would go no 
further than the hpalth professional to whom it was confided. The liippocratic Oath ' 
first set out the dut-;^ of confidentiality as f ollowsj 

"Whatsoever things t see or' hear concerning the life of man, in 
any attendance on thi? sick or e-ven -apart therefrom which ought not to 
be noised 'about^^r will keep silent " there on, counting such things to 
be professional* secreta. , - * ^ 

The modern interpretation of this oath is contained in the American Medical 
Association's Princip^les of Ethics: i 
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^ "A pljysician may not revfeal the confidences entrusted to him ir^ th« 
course of medical a"£tendance, or the deficiencies he may observe in the 
dharacter of patients, unless he is required to do* so by law op unless it 
becomes necessary in ordor to protect the welfaire of the individtial or 
the- community • ** \ > 

• 

The relationship of candid^is closure to 'Conf identiali<ty has beeTi set forth 
in a recent judicial opinioiv^ follows: ^ ^ ^ 

"Since the layman' is unfamiliair with the road to recovery, he 
cannoU sift the circumstances of, his life and habits to determine what * 
is information pertinent to his health, , . c 

"As a consequence, he must disclose all information in his^ * 
consultation with his doctor - even that' which is embarrassing, 
disgraceful or incriminating. To promote full disclosure, the medical ' • 

professioh extends the promisQ^ of secrecy .The candor which this 
promise elicits is necessary to the effective pursuit of hfealthj t>iere 
can be no reticence, no .reservation, no reluctance when patients discuss 
their problems with their dc)etors,"32 

Thus the. need to maintain confidentiality is widely recoghfz^d al& an ethical 
obligation, as pairt of the implied contract in the doctor-pati^t relationship, v 

The patient's right to conf identialityj- is populairly pdrtrsiyeti as being solidly 
entrenched. Medical dramas on television often stress the inviolability of the 
^ patie^'s, confidences to the doctor. In police-courtroom dramas lil<^ "Per^ Mason,*' 
'only the medical exajniner, a public official, testifies on medical matters? private 
physicians," hardly ever, in soap operas, in which the major action shuttles' between 
the operating room and the courtroom, physician's are orten shown agonizing because 
they aire forbidden by medical ethics to reveal some ^crucial fact which wpuld prevent 
a^iscarriage of justice, ^ 

But in real life, the doctrine of ' confidentiality -of *medical records often is 

forced ;to give way to other public interests — medical, legal or social. In balancing 

confidentiality against these competing or conflicting interests, confidentiality 

» * - • , ■ 

under America law does not begin with^ an Inherent Constitutional primacy. P^eg 

Speech, by contrast, is specifically protect^^ by the Constitution, and courts have 

rpled that it cannot be abrogated except for some "compelling governmental, necessity, 

with the burden on •the government to prove that its "necessity** is indeed 

"compelling.**. 

, Physician-patient confidentiality enjoys no such sij^eeping protection. Thirty- 
eight states- ^ifivfe laws that "privilege" the patient*s communication to the physicians 
but^these laws have inarij^ exceptions anji^.I^iver**'\)rovisionsl'^'^^ . A brief explanation 
' of the doctrine of privilege may be helpful ;to Understanding what aspects of 
confidentiality these laws do and' do not pro.'^eCt, "^^^ ^ ^ 
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A communication is said to be privileged if the person to whom thii information 
is given is forbidden by law from disclosing the information in a courtroon^ without 
the consent of the person who provided it. So privilege applies only to judicial 
, proc^edingsi it is a legal rule of evidence. Also the privilege belongs only to 
the patient, not to the physician or other health-care provider. 

Unlike the.attorney-client privilege, the , physician-patient privilege ia not 
recognized in the common law (those laws made by judicial decisions and not by 
^ legislative enactment of statutes). It therefore exists only in those 38 States 
which hav^ passed a statute establishing 'it . ' 

Perhaps the best way of understanding^ the limitations of the physician-patient, 
privilege is to lis\some of the circumstances under which* physic j^ms or other 
health professionals are (a) permitted to reveal medical informat^n about their 
\^atifintsj 6r (b) affirmatively required to reveal such informationt 

^» Public ^Report in^ Laws; Almost all states have laws requiring physicians 
to report a wide variety of conditions to public" authorities.^* There are four 
categories of reporting statutes i 

(I) Birth andideath certificates. As already noted, the birth form calls for 
conJ^fder^bie information ab^GtvJhe parents. Some states also require the filing of 
a certificate few: a fetal "birth*' ^ther by miscarriage abortion. One such 
statute was rece^itljp. aeclared unc^ohstitutional in New York, as an invasion of ' " 
privacy. * ^ 

: If death ds accidental or sudden, or if foul pl^ is suspected, the medical 
examinQi^. or ooroner is required^ to do an autopsy and file^a report of his findings 
^ with the district attorney. These reporting statutes are almost universally complie 
>ithf and failure to 4o so is generally a misdemeanor punishable by both fine and 
imprisonment. 'Ns^^ 

(II) Inrectious, contagious or ^communicable diseases. The California statu^, 
for /example, Us^si "Cholera, plague, yeilow fever, malar^ia, leprosy, diphtheria, 
scarlet fever, s«allpox, typhus, typhoid, paratyphoid, anthrax, glanders meningitis, 
Vtufeerculosis, pneumonia, dysentery, erysipelas, hookworm, trachoma, deng^e, tet&nus, 
fneagles, German, measles , chickenpox, whooping cough,^ mumps, pellagra, beriberi. 
Rocky Mountain spotted fever, syphilis, gonococcus, rabies or poliomyelitis." In 
addition, the California statute requires reporting to the Motor Vehicle- Bureau 
of any disease that might cause "lapse of consciousness" (e.g. epilepsy). ^ 

(III) Child abuse. Reporting generally cfe from\the emergency rooms* of large 
city Vs^itals. Some states have passed legislation to set-up registries ^of 
potential child abusers- in order to systematize reporting. * ! * * - 
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(IV) Wound Reports, "Bullet wound, ^nshot wound, powder burn, or any other 
injury arising from or caused by the dischgirge of a gUn or fireairin, and every case 
pS a wound which is likely to,,, result in death and is actually or apparently 
inflicted by a knife, iqepick or other.vShaLrp or pointed instrument," 

These reporting statutes are examples of IjQw legislatures have specifically 
codified exceptions to the physic ia^-patienf privilege, A ph^siciaft could probably 
'^also notify a non-government agency, such as an airline, that a pati^t-pilot 

had experienced blackouts under the same theory. The reason for this exception is 
that ^t some point, the competing interests of society outweigh both society's 
and the -individual's interests in maintaining medical confidentiality, 

B, Consent of the Patient : If a patient brings a lawsuit against a physician 
or hospital for malpractice, he/she will probably want to bring hisAer medical 

* records *ln to court to support the claim for damages, The patient may wish to 
bring medical records into court when suing a third psirty for damages in a personal 

. injury case to document the extent of the injuries suffered. No breach of 
confidentiality is involved in such cases, since the "jJrivilege" belongs to the - 
patient. In one case, for example, a psychiatrist who attempted to assert the - 
physician-patient privilege over the objections of his patient, to protect the 
patient's best interest and safeguard psychiatric^rivacy in general was sent to 
jail in California for contempt of court, 

Often, the patient's consent to release medical information is not at all 
clear-cut, ► " ^ a 

(I) '•Implied Consent", In many hospijalfs, people not involved in the patient's 
care may have access to the patient's record, including nurses on all three shifts, 
medical ^students, interns and residents,, financial workers, ward secretaries, social 
workers a^ researchers of many kinds, All of this takes place on the "implied 

* consent" of the' patient - that is, his/her very presence in- the hospital ris tak^n 
to imply consent for* widespread in-house access? this usually occurs without the 
patient being aware of i1>v 

(II) General or* "Blanket"' Consent, Upon entering a hospital, a patient may 
be asked to sign an authorization wi^lj says^ essentially that the hospital may 
release medicar information aboul^^e patient to anyone it thinks should have it,^^ 
This will include private or government insurance |)ayers, utilization review 
committees, and others monitoring the quality of patient' csire or cost^ Thus, the 
need to assure payment for medical, caire and to assure the quality of that care take 

' precedence ^over the doctrine of confidentiality. Generally, no restriction is 
t placed on the^ amount or**the relevajice of | the material that may be released or the 
use which many of these third^parties may make of this information. 
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(Ill) Partial Consent. Situations often arise in which some 'courts have 
found that the patient ha^sJW^aived" his right to confidentiality. In one case, 
a civilian employee of^ the Air Force asked his doctor to make a partial disclosure , 
of his medical record' to his employer to explain his Absenteeism,?^ The court 
held that because of this consent to disclose part of the record, :fche patient was 
"estopped" from complaining when his physician made full disclosure, including his 
.alcoholism. 

In another case, a court held that an application for life insurance was a 
waiver of confidentiality, , In this case-, the pediatrician of an infant informed 
a life insurance company of a congenital heart defect of which 'he had not informed 
the child's parents, 



irinors. 



(TV) Consent for Minors, Special problems are involved with health care for 
rs. Generally^ parental consent is required for Jboth the treatment of a minor 
and for the release of the child's medical records, 'However k9 states (the 
exception is Wisconsin) now allow minor youths to receive venereal disease treatment 
without the conseht of their parents and in strict confidentiality, " Many states 
^ have also lowered the age of consent either for all health care or for specific 
categories of treatment, such as pregnancy and pregnancy prevention,* 

t 

^' Best Interests of the Patient t Some state laws make an exception 'to th^e 
physician-patient privilege to permit disclosure to third parties in "the • ' 
best interests of the patient."- The New Jersey Statute, for example, states thatt 

* 0 ' ^ 

"[wjDthing in this section shall preclude disclosure upon proper 
inquiry, of informati^on as to^a patient's current^ medical condition to 
any relative or friena,„.if it appears that the l^if ormation is to be 
used directly or indirectly for .the benefit the patient. 

Courts, too, will give physicians wide latitude in marking disclosures that 
physicians believe are in their patients' l3est interests% A court found it 
permissible for a mental institution to which parents taken their child- for fj-' 
help to report to her school that she was "feeble-minded" ajo^to predict that "at 



* nuf^-! Hofmann, M,D,,, ''Confidentiality and the Health Care Records of 

Children ^d Minor Youth," Paper prepared for Conference on the Confidentiality 
of Ifealth Records, Key Biscayne; Florida, November 6-9, 1974, p,5, V 
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the time sh? is about sixteen, she should have progressed to about the fourth grade ^ 
level. ••^^ Although there has been little judicial explication of this exception, / 
one can deduce that ^telling a spouse of a patient's heart condition, or telling an 
employer of a roofer that the roofer is subject to blackouts and would be 
endangering his life in this trade, would probably qualify. ^ 

" 

D. Supervening Interests "^of Society : Th,^ leading case here is Simonsen v. 
Sw^son . de^ci^ed by the Nebraska Supreme Court in 1920. A man who waa visiting a 
small town was seen by a physician, who was also the F*fysician for the hotel where 
the patient was staying. The physician diagnosed syphilis and advised the patient 
to "get out of town** or he would tell the hotel. When tfhe patient refused to leave, 
the doctor noticed the landlady who disinfected his ro6m and put his belongings in 
the hall. The court decided that ^the doctor had the right to reveal as much 
information about a contagious disease as was necessary rpr others to take 
precautions against becoming infected, and that his actions, were "justified. 

\' In A, lawsuit filed in 197^, a doctor informed his patient's fiance that she 
had syphilis, and as a result, the wedding was cancelled. In this case, however, 
the doctojr had misread the premairital blood test, and the patient is suing him for 
$500,000. . ^ * 



^ The California Supreme Court bas recently extended the •'supervening interests 
of society" exception to the psychotherapist whose patient threatens bodily harm 
to a named individual .^^ The court went one .step further, however ,>^in'' finding an 
affirmative ^duty on the part of the therapist to weim the named ^victim.** 

E. The Public's Right to Know .* This exception applies mainly to the press, 
and press interest in medical records is usually related to individuals who are 
/newsworthy 7' either because of their prominence (actor, politicians sports figure) , 
or because they' aire pairt of a current story (accused crimlhal, birth of quintuplets), 
Generally, hospitals will give out only minimai information about a patient's 
condition unlesV they have Express permission from the patient to release more, as 
when a politician authorizes the release of detailed information to avoid damaging, 
public speculation. Police spokesmen sometimes release information about criminal 
suspects against their wishes. 

Two leading legal commentators, J.R. Waltz and P.E. Inbau, writing'in 1971, 
argue thatt V 



••The fact that the patient is not a ^private' person but rather a 
celebrity 'who customarily^ feeds 6n publicity. . .will probably be Considered 
of no consequence where intimate medical data, covered by explicit legal 
and ethical requirements of confidentiality are involved. The fact that 
medical data are newsworthy or will advance science is likewise not 
c ontrolling • 46 • 
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The authors state that one exceptron to this might be 'the condition of the 
Pre si-dent" since the public has a right to this information. After the 
hospitalization of former Presidents Truman, Eisenhower and Nixon^ one might include 
former presidents in. this category, although public interest in' their conditions was 
certainly not as great as when they held office. ' . 

/■ 

-A separate question is raised by the release of medical information obtained 
in a questionable or illegal manner,, as in the case of Senator Thomas Eagle ton and' 
niore recently, Manhattan District Attorney Frank Hogan.^^ The New York Post 
reveale.d that Hogan, up for re-election, had been hospitalized for a stroke and lung 
cancer, although his office said it was for fatigue. The Rost quoted directly ^ 
from medical reports to support their claim, and defended the use of stolen hospital 
records by saying- the electorate had a right to know the facts. 

In answer to the question i Does it matter how the press obtains private 
medical information? - the case law^seems to indicate that so long as the press ' . 
did not themselves commit a crime in obtaining the information, they can publish 
it with impunity if there is a legitimate public interest in it. The press will 
not be held as accessories for receiving stolen goods because the courts will 
generally find that what they received was" "information, " the actual documents 
having been copied and replaced. ^ ^ 



^« The Judicial Process? As noted, in the absence of a state statute, the 
coiiTts do not recognize a physician-patient privilege. The common law principle 
is that the courtroom is an arena for discovery of the truth, and confidential 
communications should not be beyond the 'court's reach. The late De^an Wigmore', 
perhaps the leading legal expert on evidence', argued that the privilege frustrated 
justice by denying truthful information to the coiirtsj that most information 
cbmfrtWkicated to a physician is not- intended to be held strictly confidential since* 
most of one's ailments are both app^ent antj openly' discussed i and that even if it 
were "hieant to be confidential, it would be disclosed^ to the* physician even if no 
privilege existed. ^° 

Retention of the privilege was the most controversial item in the new Federal 
Rules of 'Evidence which became law in 1975. Initial versions elirtinated the 
privilege > entirely. The final version provides that the privilege shall -be 
governed by the principles ^of the common law as they may be interpreted ^by the 
courts of the United States in the light of reason and experience . WhSre,' however, 
state law governs a case^ the privilege shall be -determined in accordance with 
state l^w." _A special j>rivilege was/retaitied, however, for communications between 
psychotherapist and patient. 



Where cdUrts have found a breach, of patient confidentiality, the cases have 
generally not turned on that breach alone. The key element has usually been 
publication, generally accompanied by a photograph of the patient, that could be 
construed as commercial exploitation or advertising. In such cases, sometimes the 
suit is against the publisher, and not the physician or other health caire provider. 
Some illustrations J 

In 1939 f Time Magazine published the story of a young woman receiving treatment 
for uncontrollable gluttony. She sued the magazine and was awarded $1,500,^^ A 
hospital was sue^ for permitting newspaper publication of an infant bom with the 
heart outside the body,^^ A newspaper syndicate was sued for publication of an 
X-ray disclosing a hemostat that had been in the patient 's* abdomen fof four years, 
Physicians were sued for filming a Caesairean section and using the film as part of 
a dobumentary A medical journal was sued for publishing a physician's "before 
. and after"' pictures to illustrate treatment of "saddle nose",^ 

Other cases indicate that publication is not always necessary. In Home v. 
Pat ton for exsunple, a case involving disclosure of medical information to a patient • 
employer, an Alabama court in I973 found that: "unauthorized disclosure of intimate 
details of a patient's health may amount to unwairranted publicization of one's 
private affairs ,, ,such as to cause outrage, mental suffering, shame or humiliation 
to a person of ordinary sensibilities,"^^ 

V 

Any discussion of the law sind confidentiality must recognize that the law is 
very sparse, |n the first place, few patients bring such lawsuits because they 
usually have no way of knowing who has had access to their records and for what, 
purpose. Even when patients leam of breaches of confidentiality, they may decide 
they cannot afford the time or money for litigation. Most important, a lawsuit 
means a public trial which pnly serves to publish the very inf orkjation they* wish 
to remain confidential, 

A further deterrent irs that the prospects of such litigation are not 
encouraging. While patients may sue for invasion of privacy or breach of 
confidentiality, or for defamation if the information released about them is false, 
the fact is that there is no reported U.S, case in which a physician or hospital 
has ever had to pay money damages for breach of confidentiality ,^^ (As noted 
earlier, some publications have paid damages,) 

Eliminating Exceptions by Statute t 

One way to increase the confidentiality of medical records is to protect them 
specifically by statute. An example is the" New York statute drafted by Professor 
William J. Curran to protect thelWulti-State Information System for Psychiatric 
Patient Records. The statute specifically declares that these recordsf aire 
"confidential and not subject to examination in th,e courts or by agencies of this 
state,,, (^d) are not public records. , .and not subject to subpoena in any"^court or 
before any tribunal or administrative agency," 



On the Federal level," the Comprehensive Drug Abuse 'Prevention and Control Act 
of 1970 provides thati ' . 

' "The secretary (of HEW) may authorize persons engaged in research 
on the use and effect of drugs to piilbt the privacy^of indiv[dua£ who 
^onno^t r^'^^K^'^ research by withholdin'l from all persons not 

^h^^^^f^^^i-*" conduct of such research the names or other identifying 
characteristics of such individuals. Persons so authorized to protect 
or 1^n^T^°^ ^"''^ individuals may not be compelled in toy Federal! State 
^ Xo id1^iily^^L^ch°I^Si;;!Jia!?^"5i^;^^r' ^^,^1.X^.. or^her proc'ee'dL^I 

In the case of PeOEle vs. Newj*^ in i973, New York's highest court reversed a 
lower court ruling that the Director of a Methadone -Clinic . protected by the Federal 
statute, had to turn^over ph^btographs of black male patients between^-he-ages-of 
21 and 35 to the police. The case arose when the witness to a killipg told police 
she believed sh4 had previously seen the killer in the waiting room of the clinic. 

Thus, a properly drafted statute can eliminate some' of the exceptions to the 
doctrines of privilege and confidentiality. ( 

3. Patient Accegs to Medical Records 



The movement to promote policies and laws to give patients access to their " 
medical records, pai^allels attempts by^ parents and students to get access to school 
records ar^d of consumers to get access to credit bureau records. All of these are 
part of a growing citizen movement to "affirm individual self-determination and t6 
place limits on the ^power of institutions to "determine important aspects of people's 
lives wi-ehout due^ process oriented ^procedures . 

AS to. medical records, when these were in fact ^sed only-by the physician or , 
the hospital, it may haVe been only curiosity when patients asked to kn'ow -Jheir 
contents. But now that medical records are widely shared with health insurance^ 
companies, government payers, law enforcement agencies, welfare departments, schools, 
researchers, credit grantors, ang employers, it -is often cru'cial for the- patient to 
know what is being recorded, and to correat^ac curacies that may affect education, 
career advancement or government benefits. , , 

This drive for patient access runs head-on i"nto the traditional view of health 
professionals that they alone should decide what patients should know about their 
records. th<it aceess^might lead patents to become confused or anxious, and that 
this undermines good medical tfare. While there are a few dissenters in the medical " 
profession who belieye that patient access to medical records is good Medicine 
the overwhelming ma^jority of health professionals still oppose it. The position 
of the American Medica^^Association summarizes the main professional view, 
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"It is our position that the right of a patient to medical information 
from his physician is based upon the fiduciary relationship which imposes 
a duty to act in the best interest of the patient. It would be a violation 
of that duty to provide information which would be hairmful to the best 
interest of the patient as a matter of sound medical judgment. It is 
our position that a physician has both a right and a duty to withhold 
information in circumstances in which he reasonably determines that it 
would pot be, ^ the best interest of the patient, "60' 

) 

Between the adamant position of most physician^ and the equally adamant 
position of, consumer advocates is a compromise position which calls for partial 
access, Dr, Simon Auster, Director ctt* the Fairfax -Falls Church Mental Health Service 
Board, commenting on a proposed Virginia access-confidentiality statute, suggests 
that patients be given access"'^ any, pairt of their record that may be disseminated 
to others so that patients wouloUjave opportunity 'in adveince to confirm its 
accuracy or to prevent its release." At the same time, he would kefep from the 5 
patient those pairts^ of the record that reflect the physician's "thinking out loud" 
or subjective impressions.^^ 

Overview of the Law on Access > 

A few states have special access statutes which enable patients treated in ^ 
hospitals to view and copy their medical records. (Some statutes limit this right 
to the patient 's' aft orney or authorized representative . ) Perhaps the most liberal 
of these is the Massachusetts statute which gives patients an absolute right of 
access' both during their hospital sta^ and after discharge. 

The Massachusetts statute, enacted in 19^5 1* was spor^sored by Edward R. ^ 
Butterworth, an attorney, who had difficulty getting hospital records for clients 
involved in cases in whidh^the records were needed. Mr. Butterworth, however, 
has recently been forced to sue a hospital thiat refused to release patient records 
even in l^iie face of the statute. His experience is , not \inique. A 1973 study of 
the effect of this statute in the Boston sirea by the Center for Law and rfealth 
Sciences oi" Boston University Law School revealed that 9 out of 10 major hospitals 
denied patiejit requests for information.^-^ Only one followed the statutory 
language. A typical response came from the Director of 'Boston's Beth Israel 
Hospital I "We would prefer to send the chair t to a physician so that he or she 
might interpret the information to the patient... in order to meClce a reasonable 
judgment op the request that the patient directly receive- the chart." A 1975. 
survey by the Massachusetts Public Interest Resesirch Group found that only 3 out 
of* 28 hospitals examined were in' compliance with the access law.^^. 

Where^ there is no special access, statute , the only way a patient may be qertain 

of obtaining information from his medical record is to file a lawsuit against the 

doctor or hospital involved (usually alleging malpractice) and obtaining the record 

through court-sanctioned discovery. This fact was noted by the Secretary's 

Commission on Medical Malpractice (HE;w) in'l973 which found that "the lihava liability. 

of mec^yjal records without resort to litigation creates needless expense and 

increases the- incidence of unnecessary malpractice litigation* "^^^ 

- * 1 
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Health professionals frequently deny patient access to medical reCoHs on the 
ground that th^ are the property of the physician or hospital. However, the few 
appella te court decisions have almost uniformly held that while the physician or 
hospital' may own the paper-^on which the record is written, the interest of the * 
^ patient* in the information is so vital that he does have alright io\ copy of it, 

^ • In one case where ^ insurance company sought access with the patient's 
authorization, the court said the hospital is only the custodian of the' record, and 
the patient has^a prope.rty right in it sufficient to allow him to copy it without 
having to sue, A New York Court held that a hospitri cannot withhold a patient 's 
medical record for the purpose of concealing the identity of a physician who may 
have committed malpractice on the patient. In a District of Columbia federal case 
r dispensary and a physician were ordered to hand over medical records ^to a 
survivihg spn^even though the -statute of limitations for a wrongful death action" 
had expired, ^ The Court held: "We ar^ unwilling to hold that one to whom a duty 
to disclose medical data is already owed is compelled ... to engage in- legal « 

" proceedings to attain a loftier status," 

_ In the area of mental health, however, the case law ia not unanimous. In a 
Texas case, in 1964 a patient was able to obtain access to his mental institution . 
records on the ground that the institution was "public" -and the records were "open 
to infection by patients. ^ a New -Jersey court found that the state access 
statute applied to eight mental patients who desired access to help challenge their 
involuntary cominl,tments and the quality of the care they received. ''° 

But in a recent Peder^i District cas^ in New York, the court decided against ' 
a patient's access on ^e narrow grpund thattieither the stat'u*ory, administrative' 
nor d«ci^onal law of N^ York recognizes a former patient's entitlement to -his ' ' 
medical files in the absence of pending litigation. "^1 The case invoU^ a.woma« 
•,who wanted her records to help her write a book about her experierfcea. This else 
is on appeal to the Supreme Court. _ - • • ■ 

Thus, in states with acgess statutes, patients often must sue. to enforce the " 
statute, in states without them, hospital medical records are usually governed by 
regulations of the, state hospital licensing agency. -A sample of these regulations 
indicates that most permit hospitals to adopt restrictive ac'cess procedures. 
While all 'States peijnit inspection upon court order,' many limit access to the 
patient's attorney or^insurance company. As a practical matter, then, hospitals 
can control access in most cases in which the patient ia not willing to resort to 
litigation. 

The access statutes ^do not cover private physician's offices, possibly because 
while legislatures were sure of their_power. to_regulate hospitals, they 
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uncertain of their power to interfere with a physician's private practice. Civil 
liberties groups report two instances erf unsuccessful attempts by patients to *gain 
access to records held by • private physicians: In one, a woman was not aj^le to find 
out whether, an infertility drug given her by a physician 20 yeairs ago was 
stilli^strol, now suspected of being related to cervical cancer in female offspring, 
In the »second,ra woman who recently wrote her doctor asking what medicine she was 
treated with a few years previously has not 'been able to obtain this inf ormation.*^^ 
^e possibility of a malpractice action probably explains the reluctance of the 
doctors in these cases . ' - - • 

The closest analogy to private physician's records and access. is ^-ray^. In a 

lower court case, and in an appellate derdsion, the courts held that the physician 

owned the x-rays and did not, have to grant access to them to the patient, 

\ 

Legal Trends Toward Greater Patient Access "* , * 

In the same way 'that the statutory and case law aire reconsidering access in 
employe r^rn ployee relatiojis, police and suspect, seller and buyer, etc., so "too is 
the doclJBpatient relationship undergoing chang^. Before 1960j^ll a physician 
needed was sufficient patient conkent to protect against an assault and battery 
action- for unauthorized touching. 'Since that time, state courts have consistently 
recognized that before giving consent,, a patient needs a certain amount of 
information about his condition, the recommended treatment, and its probable results? 
The new reasoning here is that, the patient has a right to self-determination, a 
right to refuse or tx) c*hoose between alternative treatments. 

Before 19^2, legal commentators felt safe in saying that a physician could be 
guided by the doctrine -rfiat "good medicine is good law.***^*^ In that year, however, 
three separate jurisdictions held that doctors could no longer limit their 
disclosures to what ."the average medical practitioner would disclose under similar 
circumstances.""^^ The, new test must be based on the patient's need to know , that 
is, whether the patient was told enough aboUt the treatment and its risks (death, 
^ disability recuperation) to deci^ Whether to accept the doctor's recommendation. 
T'his duty to disc.lose\, ironically, was "based precisely on the "fiduciary nature" 
^of the doc tor-p5it lent relationship^^hat the AMA has relied upon to deny patients 
access to/l^ffeir medical records. These decisions aire as yet the rul^ in only ' 
a few states, but they indicate the. trend of some courts to vi§w th§ doctor-patient 
relationship as a decision-making partnership instead of as a medical monopoly. 

'//hile the courts- have .taken a giant step in recognizing patient autonpmy, 
physicians may sfill invoke the "therapeutic privilege*' to denV access. The general 
rule stated* by the California Supreme Court in Cobbs vs. Grant is: "A disclosure 
need not be-^ made .. .when a doctor can prove... that the disclosure would so seriously 
upset the patient that the patient would not (be) 'able to dispassionately weigh 
the risks of refusing to undergo the recommended treatment." (emphasis supplied)^^ 
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While this tends to limit the doctrine of patient access, it does not put the 
physician back in ultimate control of patienttinf onnation. It is now presumed that 
H^^^ every adult patient will be fully informed unless-las the court held in Natanson vs. 
- Kline - the phy&ician can prove that "a complete^isclosure could so alarm the 
patient that it would, in fact, constitute b^ medical practice ... In the * 
ordinary case, there would seem toy^^e no warrant for suppressing *f acts • 

, While- the limits of the "therapeutic privilege" have not been carefully defined, 
at least one court has recommended that wherever a physician invokes it, he or she 
should be required to disclose the infonnation to a close^ relative ,82 The problem--, 
with this approach is that it may be' used to restrict the competent patient's role - 
in decision-making, treating him as though he were incompetent, even though he is 
not , 



The Federal Pr^ivacy Act of 197k and Tts State Counterparts 

All of these issues--of privacy, confidentiality and patient access--are 
being directly affected by passage of -legislation controlling the use of information 
by government* agencies as primary health providers. The Federal Privacy Act of 
197^ requires federal agencies which maintain identified records on individuals to 
1) list those data systems and their purposes in the Federal Register ! 2) (;5llect 
only that information which is necessary for the agency t6 perform its duties/ 
3) state the •'routine uses" of the data collected, for which it is not necessary to 
obta^in the data subject's permission; k) obtain the individual's signed consent, 
for all other releases of information, 5) keep a log of all such data exchanges, 
ahd 6) provide data subjects with access to their own records and the opportunity 
to correct inaccuracies. 

In addition, seven states have passed similar Pair Information Practices Acts, 
(They are Minnesota, Utah, Arkansas, New H^^^ire, Massachusetts, Ohio, and ' • 

Virginia.) ' ' ^ ^ 



MEDICAL RECORDS FOR SPECIAL POPULATIONS 

^ . . . ' ^ ^ . 

I' - 

Large groups of people have medical o^e made available to them because of 

their special relationship. to a particular institution or organization! the armed 

forces provide medical caure for servicemeni correctional institutions provide it 

for ir^matesj some -industrial corporations provide medical care for employees, and 
some colleges plrovide it for students, j 

Under these circubstances, the health care providers are not usually 
independent practitioners but employees of the institution^ While part of their 
function is to Sjarve their patients, another part is to advance the goals of the 
institution. Sometimes^ this dual loyalty serves both the patient. and the 
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institifti^n wellj sometimes the conflict in loyalty undermines the doctor-patient 
relati'ooship and interferes with the delivery of medical care. 

What follows is a brief review of some aspects of medical record-keeping 
practices in correctional institutions, the armed forces, employment and colleges. 



Correctional Institutions. What must be<«semphasized ^irst is that medical care 
in correctional institutions, like every other, aspect of inmate life, is subordinate 
to secxirity. Almost invariably, security consideration^ govern where medical care 
is given, when it is given, and who participates. This means that patient. ^ 
interviews, starting with admissions, are never conducted in private. There are 
always .guards present, and almost always other inmates. At the daily sick call, it 
is not customary to keep records at all. - , . ' ' 

V ^ / ' . . ; 

Here is a description of daily care at Attica prison, in New York State? 

"Dr. » Williams spent toost of his time with inmates sepairated from 
them by a wire screen. When they linad up for sick call, he and, an 
associate prison doctor/ Paul G, Sternberg, were on the other side of * . 

a waist-high counteri the screen ran from counfer to ceiling. No '* 
^ examinations were given, except in rare cases. The patient described j 
— his problem. Through the sdreen, the doctor gave him medication, often 
aspirin, .sometimes a placebo, not infrequently a ,tr?uiquilizer if the 
complaint was psychological. Sometimes one of the doctors would dismiss 
the complaining inmate since both believed they could tell by looking at ^ 
a man whether he was malingering." 8J^ 

In the District of Columbia jail, the sick call is almost identical with the 
one described a^ove, except that a pre-sereening of inmates who place themselves, 
on sick call is conducted by Medical Assistants, inmates who have already 
convicted ^f crimes and who, ironically, are^ accorded higher privileges tfil; 



those awaiting tri^il. The Medical Assistants make the rounds of the cellb]|ocks 
and dispense aspirins to those inmates whom they do not consider .ill enough \o go 
on sick call. As in the other two institutions, prisoners with medical emergencies ^ 
are taken to the city 'hospital for treatment, ' * ; ' 

Thus, for the gfeat majbril^ of the prison population in these institutions 
and others like tliem, there is very little formal medical record-keeping, except*^ 
for the^ relatively rare prisoner who is ^treated in an outside city hospital, j 
Copies of these ouiside medical records ^e given to the institution's administrators. 
Sometimes "they are not even given to its medical staff. ! 

The lack of medical records for inmates treated in outside hospitals handicaps 
the limited mediqal staff of the prison even further. Dr. John L.S, Holloman ^ 
recounts the difficulty of dealing* with a patient in New York who had been shuffled 
often between the jail and the county hospital, 7^ The inmate was** suffering If rqm 
severe neurological damage. **He has made numerous trips to the hospital facilities. 
Nevertheless there* is no medical information concerning the .prisoner available to 
the medical staff here. To send patients for care and then to fail to keep useful 
medical records seems to be a waste of effort and money," ' % 
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According to Arpiar Saunders^ Associate Director of .the National PriatJf! ' 

Project, most medical information about prisoners is placed in their general 2^ecords 
by non-medical personnel, primarily guards, but sometimes by prison teachers, 
social workers or the clerical staff. . 

If the facility is a detention center rather than a permanent prison^ the 
general record, including medical information, follows the prisoner wlien and if be* 
is assigned to a permanent institution/ ^Many permanent prisons assign inmates to " 
eellblocks accOTding to the seriousness of the crime, and also according to the 
evaluations made ^n the dettntion center. If the inmate's record shows ^lat he 
was a -tr-oubi^maker," or a homosexual or a malingerer-, he may be assigned to an 
undesirable cellblock, or a segregated .cell, or put on -deadlock *• (confined 
cell with' no privileges). 
• ■» * - 

Inmates \records. are routinely available to prison personnel. In addition to 
playing a role in initial' cell assignments, they are usfed by disciplinary boards 
within the institution and may play a role in determining the severity, of punishment 
for an infraction. They are also used by parole, boards, who give considerable 
weight to derogatory comments by guards when deciding whether or not to grant parole. 

Medical Records in the Armed Forces i Militafy doctors have an affirmative duty 
to report to the military command any medical information they think relevant- to 
the soldier's performance or status. "Military law, quite simply, does not'^ 
recognize the physician-patient privilege," according^ to Captain David B. Knoll of 
the Judge Advocate General Corps.®® He g-oes on to note that "...A military doctor 
Ijerforms examinations As part of his official duties, and inf or;itation thereby 
acquired Would be official. Maintenance of complete medical records on all persons 
in the milLtary" services is of substantial concern to the services themselves." . 

The lack of a physician-patient privilege d,s crucial for members of the armed 
forces since the medical information they volunteer to military doctors may be used 
by the command to determine their fitness for promotion, or whether or not they 
should be summoned before an administrative hearing board or> court-martialed. If 
either of these disciplinary procedures is' invoked, military dobt<3rs may give 
evidence at them based upon what the serviceman or woman confided in them. 



Where k court-martial is a possibility', military physicians are required to 
,give the patient some form of an "Article 31" warning that what he says may be. used 
against him. The "military 'iversion of the Fifth Amendment provides: ".. . .no. person. . . 
may interrogate or request statement f^.om an'accused or a person suspected of 
an offense without first informing him of the nature of the accusation and advising 
him that he Moes not have to make any statement regarding the of fense. . .khd thft " 
any statement made by him" .may be used as evidence agaiilst him Jh a trial by ' 
court-martial." The mililkry physician,' however, does not have to use the formal 
language of Article 31. It is enough for him to tell the patient that, whatever he 
says during an interview isjnot privileged. j 
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However, no such' warning is necessary unless a court-martial is in the offing, 
as a recent case demonstrates, A private. ^Foluntarily consulted an Army psychiatrist 
for help about his homosexual^ fee lings. ' On the following day, the psychiatrist 
filed a detailed report with the soldier's superiors, and recommended that he be 
discharged for adminis-trative reasons under the provisions of the regulations 
regarding homosexuality (undesirable dischargey. The* recommendation specifically 
noted that there was np evidence of a mental illness which would necessitate a 
medical 'discharge. U medigal' discharge, entitles a soldier to veterans' benefits ♦) 
The soldier describes the consequences of the psychiatrist's recommendatipni 

, ^ "Discharge proceedings were begun- against me and, 'after b^ing 
threatened with a court-martial, I signed a statement and waived my 

right to counsel and a hearing,.. Shortly thereafter H and others 

told me I had tq name names or I would not get out. Under such coercion,. 

I named P and then, regrett^.ng what I was forced to do, I denied it 

and all the- other admissions as well,., 

^ • "In the ^ast ten years my undesirable^ discharge has haunted me,,. My 
civil service job application was returned, and Bank of America rejected 
an a^jplica^ion for a Federally Insured Student Loan, ,, The VA also denied * 
me my veterans' benefits. Despite the incidents ten years ago, I repeat, A 
as I did then, that I am not a homosexual,,'," ' ' ^ 

^ As the abovj^ case makes clear, medical information not only *af fects the 
serviceman or' woman's career while in the armed forces, it also affects the kind 
,of discharge he or she receives, which in turn affects the veteran's opportunity for 
employment' and his or. her eligibility for veterans' benefixs. 

Until IVarch, 19?^f ' serviceiren and '^omen were^.gjveix a 'separation Prf/ram Number 
on their general or* honorable discharge papers which, iinbeknownst to the veteran, 
w^s a co^e to employers and .others and whic?i frequently signified derogatory 

' information,^^ Many of these numbers wer^ based on medical information , or records. 

t Among t^emi • * '* * ,^ 

. Codes 2^9-257 - homosexuality; 261 - Psychiatric or psychoneurotic disorder'; 
'262-263 v^edwetting; 264 - behavior disordersr 27^.277,278 - physical disability , 
not entitled to severance pay; 287 - unclean habits, venereal disease;^. 288- 
anti-social behavior; 289 - alcoholism; 361-362 - homosexual tendencies (without 
overt homosexual acts); 369 - cyclothymic personality ^(manic-depression) ; 
375 - failure to meet medical fitness standards; 384. - drug abuse; 388 sexual 
perversions; iflE obesity; ^B, 46d - sexual deviate; 460 - schizoid personality; 
480 - personality disorders; 552 - court-martial, homosexual; 651 - physically 
disqualified* 

More 1>han 490,000 Vietnam veterans have been given sUch derogatory separation 
numbers. While these secret numbers may fre'quently ' adversely affect a veteran's 
job opportunities, an undesirable or dislhonorable discharge is virtually certain 
to do so, ^^uch, discharges are also sfn outright bar to veterans' benefits in 
housing, education, pensions, medical care and civil service ratings. 
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Medical Recorfls in Employment • ' ' 

\ ' ' ^ ^ 

^ . 'Although virtually ail J)usinesses provide group health insurance coverage to , 

their employees, most corporations limit primary medical care to first aid st^timi^^^^ 
and periodic health screenings. The IBM Company is a good example of a large' ' - 
corporation's occupational health program in which special attention has been 
^given to the%rules for information use, jj^ 

IBM has 250^000 employees, 150.000 of them stationed in the United States. 
Its dbmestic medical departmerrt employs 120 nurses, ^32 full time-physicians, kO 
part-time specialists, including psychiatrists, and 250 "fee, for services- 
physicians. Its medical facilities handle ^650, 000 employee visits per year, 
150,000^- of. which involve pHysician contact,^^ 

Between 10% and 20^ of all first-aid. visits are' for occupational injuries, the 
remainder are for non-ocqupational illnesses or injuries. In addition to providing 
treatment for specj^ic complaints, IBM offers a Voluntary Health Screening 
Examination Program. Approximately 75% of all employees participate in this 
multiphasic screening system. .In |he introduction to the pamphlet explaining the 
Screening Program, employees aire tolfli 

J 

. .J"?^^ program/is completely voluntary , and the -decision to, take part 
• IS entire^/up to you. I also Want to emphasize the coiif idential 

nature of your examination results which are seeh by the professional 
^ staff _memb.ers of the IBM Medical Department, your personal physician if ^ 
■ U^'alll^LT'^ ^I?? instance where health inforaation ^ 

IS obtained during an examination would have. to be revealed is when an .^--^ 

^por?ld indfr"s?a?e° llZ'^ '"'^'!'^'^ communicable disease wh|ch must 

I , ■ . i " 

The Voluntary Health Screening Examination Program is designed, according to 

Dr. John Duffy. Director of IBM's Medical' Department, "do give tfie. employee advance ? 

j»aming of the most commop- chronic, health, problems, as well as to .alert the ' i 

employee to conditions which could cayse future health problems. keSfrequency ' • 

of medical screenings depends on an .individual's age. The older a;' person becomes/ , , 

the more often the screenings take place." ' * 



All resylta pf tests comprising the ' Screening Exefoination ^e fe^ into a"" : 
computer which compares them with the expected statistical profile for the employee's 
sex and. age,- and with any earlier Screening Examinations that the' employee may have 
taken. The computer then, produces a detailed report of the-Screening Examination, 
makiijg special note of irreg^ilarit'ies. The report is then forwarded to the IBM " 
Medical Department where it is inserted into the employee's confidential medical 
record. If a potential health problem is disclosed by' the report, an IBM physician 
or nurse will suggest tM*.tfiB employee consulF-his or her personal physician. 
Upon receiving the consent 6f the employee^ the latter's persopa^rfhysician w.ill be 
advised of the results of the screeSTng examination. Dr. Duf^especially notes 
that -the results of the examination. will have no effect whatsoever on the employee's 
job." ' . • ■ , 
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In addition to its express purpose of adyi^ing individual employees about their 
health, the program is designed to furnish statistical data. With the aid of the 
computer,, health examination information is gathered "on men and women of widely 
varying ^ge^ geographic location and, medical history.' The^ results in summary form 
enable the IBM Medical Depairtment to develop prognostic techniques. .The "brochure 
describing the research aspects of the program points out thati 

"All medical data used in these reseairch studies will be handled in 
a completely confidential and anonymous manner, and will in no way identify \ 
individual participants in the program. ** 

Although the Medical Department does not make medical records available to 
company managers or supervisors, it does, with the employee •s knowledge,' inform 
management when a r^ical problem is work-related, so that an employee with 
epilepsy, *f or example, would not ^e assigned to handle hig*h-voltage equipment. 
Approximately 5^ of all employees are within the Bureau of Labor Standards definition 
,of handicapped, and 20^ aire subject to restrictions (epileptic, controlled diabetic, 
etc.) The same policy is applied to the psychiatric consultation provided. If 
there is no problem with^perf orman^ at work, there is no feedback to management. 
"When illness IS impacting job performE^ce or a job is contrvibuting to illness, 
management is given, on a need-to-know basis, the recommendations which will best 
serve the needs of • the employee and the* company . " > 

■. . / ■ ' ' • 

IBM comi:lie,s with all State and Federal reporting requirements, including 
findings of drug abusfe among employees airid infection with communicable diseases. 
It. complies witJi...4he re cord -keeping requirements of the Occupational Safety and 
Health Act which requires the maintenance of up-to-date records on occupational 
injuries and illness to be made available on request to gcjfernnient officials. The 
company must also furnish appropriate records to the Workmen's Com'p6nsktion Bureau 
^ on request. . * . ^ j^* 

In this connection. Dr. Duffy noted tha\ while Social Security numbers are 
used in filing' these .Workmen 's Compensation reports; IBM uses it's /)wn numbering 
. system for internal medical records* of its employees. ^ ^ 

. 

When I'BM Medical Department records aire subpoenaed, the company will copy 
medic^ department records and send them to the employee's personal physician upon 
'receiving the written consent of the employee, . ' - ^ 

y . * • ^ 

The rarjge of medical services provide<^ by IBM for its employees is typical,, of 
the practices) of the big corporations listed in Fortune magazine's Leading 500 
Companies/ The special policies that IBM has adopted to protect the ^privacy of 
eijjployee medical records will be desci^ibied in the concluding^ chapter . 
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Medical Records in Colleges \ 

Ma^y colleges and universities maintain student health services where primary 
care is provided by physicians and other health professio;i^ls^i)loyed by the 
school, (Elementary and sec^ondary schools generally providSSonly specialized 
services such as immunizations, eye and hearing tests, etc. and these record- 
keeping practices are described in Zone ili.) ' , 

' \ 

A survey conducted in 1968 of 165 American colleges and universities (and 8 
Canadian universities) examined 'their medical record-keeping practices, While 
the purvey focussed primarily ' on ^student psychiatric records,' it revealed some 
general medical record kefeping procedures as well, * • 

Virtually all of the* schoo^ medical directors acknowledged the need for 
confidentiality of student medical records. As one medical director put itt "If 
^ the student body dpes not know without any doubt that their contacts with the 
^ health service will^be 'treated ^as privileged, then the very effectiveness of this 
health service is ciuickly lost'" But in spite of the endorsement in principle, 
the practices among schools- vairied widely, 

« 

'* . Informing Parents i The great majority of American schools - \hS in all - 
responded to the survey by stating that pareiits^are not routinely informed by the 
health service when the treatment is for short-term illness or on an outpatient 
basis. Most of the schools, however, do notify parents of hospitalization, serious 
illness, or a suicide attempt, ThQ eight' schools which do not inform parents under 
any .circumstances are all graduate schools where the g^eat majority of students, may 
be assumed to be over 21 and/or married, • . ^ * 

^ The 20 schools that do inform parents of. all treatpiem; by the^ student healthv 
.service%do so for one%r more of the fallowing reasons t (a) the school believed it 
. ^ has a moral responsibility to inform -parents j or (b) believes it has a legal 
responsibility. to do ^o, or (c) believes that since the parents are paying the 
school bills they^have a right to the inf onnation, 

^\ Informing the Administration . Where the student himself .'seeks treatment — 
either general or psychiatric the administration, and faculty of the school are 
generally not informed without the consent of the student unless the student is very 
ill, or' his condition poses a danger to hijnself or others. Fifteen'bf tjig schools ' 
.report the names of all studejits hospitalized in the college infifmary, but without 
diagnosis, medical hr psychiatric. Fprty-f our- schools report to the administration 
when some sort of scheduling adjustment i^ required', such as withdrawal If rom school, 
or a course change , or a dormitory change , but this is done with a minimum of 
■ disclosure from the student's tecord. The medical service might request a change 
in schedule because, of "a stressful situation," or because roommates &re. not 
-psychologically compatible," without giving details about the actual conduct of 
the student, ' ' * , 
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However, when the administration refers the student to^he Rental health 
service, the majority of schools will inform the student at the outset that a report 
will be made- to the dean. Many of the schools indicate that they discuss the 
evalua^tion i^th the student before givir/g it to the dean. , 

3j Informing Outside Organizations ! Only eight American schools report that 
they will release medical information to outside, organizations without student 
^ consent^ All of the others state that they would reveal no information without' 
student consent (or- without parental consent if the stydent is under 21), However, 
this may include the ijoutine or blanket consent that students give when they 
indertake treatment, or it may include a blanket consent signed in connection with 
an insurance application or a licensing or employment application. 

Some schools say they require informed consent; that is, they call the student 
In and ask him about the specific inquiry and discuss the information they will 
release if he/she permits it. "^This protection, of course, is useful only when the 
student is still in the college. Mkny inquiries aire made after the student has 
^aduated. 

Nineteen colleges stAte they will release information with student permission 
only on a~ Vspecific reque^st," although it is not clear what the^ specificity refers 
to. One college among these explains that it will* respond only to "specific 
questions" about the student. It reports that after instituting this c«quirian^nt , 
tde number of requests for information has dropped from^^everal per week to three 
or' four a ye ar . • . • " ^ ^ * ^ 

thirteen American universities indicated that they refuse psychiatric 
information to an outsi/ie agency even with/^he student's consent. Six of these 
make an exception tor a new therapj£t_J;fl<an(;ther school who is continuing to treat 
the student. This is the position of the Psychiatry Division of the Berkeley 
Student Health -Service : S 

"Years of experience" and discussion have led our staff to conclude 
that we cannot comply with such requests (for information and opinions 
about students who have used our services) and that communication" about 
our work with students is justified only for the purpose of contributing 
to further psychotherapy elsewhere. . .Our attitude and policy about 
confidentiality are not affected by a student's having Jjrovided his - 
- release or consent to communication." * • / 

The praictices of the majoHty of schools Kith respect to informing parents 
and^'aclministration officials cwiforrn to the general standards set by the American 
College Health Association. BuxXcHA standards are not followed by the majority as* 
to releasing student medical records to outside organization. The ACHA would permit 
more disclosure to groups such as draft boards, insurance companies and prospective 
employers than th^ majori^ty of colleges are willing to make. 
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The ACHA would give, with student consent, *'more specific information about 
d^^gnosis, results of therapy and prognosis" than would be given to university 
admissions committees. And^it would allow even further di«x;losure to the' FBI, the 
Civil Service Commission and the armed forces. For these agencies, ACHA suggests 
"a general review of the case history along with guardeS prognostic speculation in 
the course of an interview with the investigating agency... but even this should 
only be done if it is clear that refusing to give information will be seriously 
damaging to a former patient," * " 

According to thte survey^ one of the factors which has caused stiffening of 
resistance to disclosure of s.tudent medical records to outside agencies^ has been 
the experience with the Peace Corps. "(It) comes armed with a student consent and 
asks for full information. Many of the schools that have developed new policies 
in recent years to avoid, disclosure of records have done so because of the growing 
number of requests for information from the Peace Corps," 

In 1974 Congress pai^sed the Family Education|l and Privacy Act (the so-called 
Ruckley Amendment) which sets rules of Confidentiality and rights of student access 
to records in schools and colleges, including medical records that are maintained 
by such institutions. - • 



^ ^ CONCLUSIONS 

If f rea medical ancf health care could be deliveMd by doctors and paramedics on 
the proverbial desert ^island,, freed ^rom all the surrounding obligations of organized 
society, the citizen r'ight^ issues present would involve relatively . manageable 
problems. In urban societies^ however, the. primary care providers fe have described 
in Zone I are^ under many legal and social obligations disclose personal medical 
data. These obligations are growing greater and greater §ls society tries to cope 
with problems of improving public health, occupational health and safety, research 
into diseases, evaluation of health care systems, and similar activities. In 
addition, most patients now have tjiei;r doctor and hospital bills paid by someone else, 
requiring ^pe^rson^l and medical data to be disclosed .for service payme4^ and care ' 
review. ^ . 

In the face of these unavoidable * realities , the records generated in primary 
care settings'^an no longer be treated solely* in terms of what information doator 
and allied health professionals jieed to do their job. Precisely because law and 
public norms require considerable disclosure .of what is collected here, the 
recording of personal data in primary care can no longer be analyzed in isolation, 
and the delicate balances of the doctor-patient relationship treated by themselves. ^ 
What is gathered and recorded must be seen today as the start of a complex process 
of outward comdunication, with medical da^ta going into many areas far Removed from 
direct patiOTt care. It is to these additional use^. that we now turn. 
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CHAPTER 2. .ZONE II - SERVICE PAY£RS-*XND HEALTH CARE REVIEWERS 



Medical- records in Zone II aire not used for the delivery of primary health 
care by government and private agencies. They are used.^or two separate but closely 
related purposes. The first is for the payment of health care for those individuals 
eligible for medical benefits under government programs or private insurance plans. 
The second is to monitor the costs and quality of caire given to these patients. 

Medical Service Payers ^ ' 

One hundred ninety million Americans, are covered by some form of public or 
private health insurance. The estimated tot^l cost of this insurance .ik $57 billion 
dollars a year. Health insurance is not only a major American 'p2?eoccupation, it is* 
a major occupation as wel^:* 150,000 Americans work for federal, state and local 
government health insurance plans; Blue Cross-Blue Shield has 70,000 employees;* 
private commercial health insurance companies employ 500,000 people.^ 

Service payers .whether government agencie^'or private companies, need to have 
positive i(ientificatiorr"of the. patient and to know what medical* services he or she 
received. Without this basic information, they could not honor claims for benefits 
or reimburse doctors and hospitals. They frequently need more than this basic 
information to protect themselves against fraud by the patient or by the health care 
provider. Private companies also collect medical information and other personal 
data in advance oT granting insurance coverage to make certain that the individual 
is a good medical and financial risk. What follows is a description of hQw service 
payers operate, what their sources of ^medical information aire, and Ixou they use 
the medical information they collect. ^ ' 

Private Service PAVers • ^ - 

•■ '\ . ■ • ■ ■ . 

In I973, lS2_million Americans were covered by some form of^T^irtvate health 
insurance. Insurance companies provide 60% of this coverage today , Blue Cross-Bliifi 
Shield provide {M^^and other prepaid insurance plans provide 9%. (Tfiese ifigures 
add up to more than- 100% because many individuals have coverage with more than one 
organization.) More than 75'million Americans have some f orm -df disability insurance? 

Widespread as this •health insurance coverage is, it is by no means universal. 
Some 20 million Americans have no^c overage 'at all, Nor 4s coverage evenj^r 
distributed in the population. Some families are covereti for only a small Traction 
of their medical bills, -^/hile .others are enrolled in programs that provide a full 
range of medical services.^ All of this means hat for every * individual covered by 
private insurance, decisions must be made as to his or her eligibility, what rate 
he or she should pay, and', orice-^'-cov^ed , whether clain)s for. ^Qnefits should be paid. 



t , 

Most health insurance coverage howeven, is not-by individual poli#. Group 
health insurance policies cover 83 million Americans, compeared jy^ith onlj^ 4b million 
Who have individual policies.* Employment by a particular f irm^arantees health 
coverage at a rate common to all the employees without any requirement ' that ' 
individual workers provide medical atRformation about themselves. The rate the 
group member pays depends not on his or her •physical condition, but In decisions 
the employer makes about the whole group. This cao affect hiring policies when 
employers try to., keep insurance rates low by hiring the "right" kind of people. ^ 
(This will be discussed in the Employment section in Zone III.) 

The inf ormation/^Ptained' from the individual's application form is the major 
source used for health underwriting decisions; On it, the applicant may be asked 
to include recent hospitalizations, major illnesses, a medical history, the 
existence of "nervous" and mental disorders, etc.^ No insurance company investigates 
all applications, although most of the larger health insurance firms check new 
applications against their previous applications and claims files. ^ 

Little is known about what percentage of applications are checked fur4;her, or 
how the decision to check further is made. " Mutual .of Omaha, * the largest provider 
of private health insurance , .stateV that it checks only 5% of health insurance 
applications beyond the application form.*^ (Mutual's operations "are described*in 
detail in the Profiles section.) . 

.Once a decision has been mad^to go beyond the application form, private 
iVisurers may check physicians' or hospital records,' Insurance applicants sign a 
release form when they apply, giving the company access to medical records and 
other sources of information, and patients entering a hospital are required to sign 
a form giving the hospital authoriH;y to release their records to insurance companies 
and others. 

When an'inslirance company fipds something "doubtful" in the application, or 
the check of its own files, it may order a further investigation. The doubtful 
information could be about the applicant's surroundings or a dangerous occupation. 
Checks are also made when the application is for a large amount of income -protect ion 
insurance. The investigation may be matie by the company's own investigative ^ 
deparliment, but more likely it will be conducted by an outside firm that specializes 
in investigative reports, such as Hooper-Holmes, Service Review, Inc., American 
Service Bureau, O'Hanlqn's Report, or Retail 'Credit Corporation.' 

The largest of these companies is Retail Credit, which employs 8,500 people in ^ 
1,600 branch offices in. the United States, Mexico", Canada and the West Indies.^ 
Its reports for health service payers include giot only information about the 
applicant's health, but frequently comments about personal habits and morals, 7 * 
employment, police records check, income and indebtedness. ^ 
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^ Processing of Health Insurance Claims 

\ ^ ^ ' 

J.*n the processing of claims, the patient's medical record is the chief source 
of information, often the only source. The health insurance industry routinely 
collects three types of information from the patient record:^ 

patient identification, including name, address^ name of subscriber, 
relationship of patient to subscriber, patient's occupation and empjLoyer, age, sex 
and identifyihg number j " > . ^ 

(2) clinical information, including attending physician, referring physician, 
description of accident or i*llness, description of operations or med[ical^ prOcedur&s , 
and final diagnosis and complications; 

(3) financi^JL information, including length of stay, charge per day, and ' 
accommodations. 

In the felue Cross system, after tftis material has been used for reimbursing • 
the patient or the hospital, the oclinical'inf ormation is usually separated from 
the identifying information and is used for actuarial ratings, claims and 
utilization .review, administrative studies and rese^ch.^^ 

Blue Cross has developed a three-level claims review procedure. Level ane 
consists of screening all claims against established parameters of length of stay, 
ancillary charges and other standards which identify misutilization of services. 
Claims that are not approved at Level One are likely to involve unneces^sary private . 
room charges; diagnoses of chronic diseases without mention of current exacerbations; 
symptoms rathei^ than diagnoses, unusually long or short hospital stays; unusually: 
higla or low ancillary charges for particular diagnoses; and Blue Cross contractual 
exclusions, Lev^l One claims are reviewed by specially trained klerks. 

... • ■ . ■ \ # 

Claims ^referred to Level Two are usually evaluated by Blue cVoss staff 
registered nurses, 'where len^th^of stay is being reviewed, in addi^t^on to the ^ 
established standards, the reviewer willf consider the age of the patient, the 
hospital involved, secondary diagnoses or^complications , days spent in intensive 
care, and use of ancillary services. 

A 

In addition, some^^'conditions automatically call for review at Level Two^ Among • 
them are pbesity, rehabilitation procedures, maternity, cosmetic surgery, f ^ 

pre-existing conditions, dental care, hospital stay for diagnostS^ purposes, and 
mental a^^ervous conditions. The mental arid nervous category includes alcoholism, 
drug addiction, attempted suicide, psychoneurotic and personality disorders, * 
epilepsy, migraine, colitis; convulsions, and other conditions'. Pinal diagnoses 
"th^t mention only the above require additional information before the claim is 
revieweM. A request is seni to the" hospital for copies of physicians' orders,' ^ 

present illness, history of^past illriess*, examination and test reports^ 
progress . notes, etc, o 
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If a claim cannot be approved at Level Two, it is referred to Level Three* for 
further review by a Blue^Cro^ staff physician, who may make additional requests 
to the hospital for iitf onpertion, including the patient's entire medical record. 

. The reason jTor this 'three nleyel approach, * be:^ond identifying those conditions 
that are not covered by the contrapt, is to review those diagnoses that most readily 
lend themselves to fr^ud by physicians and other hea^lth-caire providers, Cut-and- 
dried medical procedures — setting a broken leg, for, instance — present very few 
such opportunities. But illnesses that require long-term therapy, where the outcome 
cannQ;t^^bej)redicted, are prime possibilities for drawing out the treatment^-ajyd for 
exaggerating the amount of caire given to increase the amount of reimbursement due 
to the health-care provider. Whil6 insurance companies feel that for^th^s reason 
u Records in this category deserve closer scrutiny, the health-care providers feel 
^ that such record^, especially psychiatric illnesses, should be protected against 
unnecessary -examination because of the sensitive materials they contain. 

According to a report by the American Medical Records Association In 1974: 

"*'There are two basic problems that severely affect the processing 
of claims in any Blue Cross plaii and probably in all health insurance • 
companies: ^ insufficient information and incorrect information. .Money 
and manpower could be saved if hospit^s care&jjly controlled the 
submission of information t^, 



nission of information to. insuranc* companfe«ij and if in turn these 
companies notified the hospital precisely ^ ^'cfditional information is 
reauired. " - -jswi^ *^ 



citizen Rights Issues 



Access I 



Since 1971, Retail Credit and similar firms }\ave come under regulation of 

^fl 1 Pa-IT* Priori •?+ pA-r^/^v^4• y%rr A «.+ H A i ^ 



^ the Federal Fair Credit Reporting Act."^^ An insurance company or employer who 
wishes to have an investigative report prepared on an applicant must notify the^ 
applicant of this fact, briefly describing the topics that the report will cover. 
^ If the applicaa^^is turnetk dovm on the basis of information in ,the report, the 
^company iriust notify the applicant of the name 6f the agency that produced* the report. 
The investigating agency is then required to discuss each report wijth the applicant 
o 0 at his or her request. It must inform the individual of the contents of the rep^ort 
but is not required to show it or to provide a copy of, it. \ . . ' 

^ Several exceptions under this' law are important :-^aims. investigations ar^ -^ot • 
covered. a^Medical information does nof have to be discussed. In*-.ht)use'' insurance 
investfgatiVe departments are no): covered. * , 

A Senate bilj S.X^kO, introduced in I975. to amenh the Fair Credit Reporting Act,^„ 
would end these exceptions .-"-^ .It woqld require that consumers be given visual 
apcess^o their files as well as summaries of their contents? it would specifically 
give- consumer s_: the right to the medical information in their files 1 it would disclose 
the sources^of investigative rej)orts, whether in-house or by a compfi^ny .such as 
Retail Cre<iitj it would provide advance notice to consumers that a report is being 
made^on them for^ .employment purp6ses, and it would notify consumers at the'time an 
\ investigative file is opened on them. ' . ^ * 

erIc ■; ■ ■ 



.The amen<}6d act would require specific consent, rather, th?m blanket consent, 
for the release of medical information, including a notice on the consent form 
that the material will be sought 4fe''kept by organizations like Retail Credit as 
yiell as the insurance company requesting 'the dnformation. The proposed bill"^' / . 
would also give the Federal ^Trade Commission tJ^e power|to prohibit investigative 
reporting companies from setting quotas for derogatory information, 

; ' ' ' ■ ^ ^ 

The number of complaints about lack of access to service payers' records has 
not been high, in part because policy-holders seldom leairn of imaccuracie's in their 
records. It is also because — although they have signed bj?oad .release f<^nis both 
as patients and as appllcants--the policyholder is usually unaware of who precisely 
gets his medical inf ormatiC)h, amd how much detail is in the medical records that' 
are transmitted to servic^^ayers , 

Confidentiality t The major issues in service payment concern the 
confidentiality of personal%medical data. Most of these arise because of 
ambiguities in the ethical and legal nAes governing disclosure of medical data to 
employers or government health funders. 

There are many incidents in which sens^ive medj.cal conditions of individuals 
were tiisc^osed to employers by heal^th insurance firms Sometimes this was done 
directly, on the assumption that employers were entitled to know because they paid 
all or part of the premium. Sometimes disclosure took place through the way that 
initial claims processing was handled by the employers, as when an employee's 
supervisor had tc^ sign claims subirfi'tted to the firm's insurance carrier; or when a . 
medical claims unit in the personnel, de pair t men t considered it appropriate to inform 
management of certain medical conditions being claimed (psychiatric treatment, for 
example.) There aire instances of private companies doing work that requires 
Defense. Department cleairanpes for employees passing on to the government information, 
derived from medical claims that employees were -^receiving psychiatric care, on the 
assumption that this might affect the continuation of the employee 's .security 
cl^aran^. , ^ , ^ ^ ' o • 

Dr. Maurice Grossman, Clinical Professor of Psychiatry at Stanford Medical * 
School, and chairman of the Americsm Psychiatric As socia'^: long's Task Force on 
{^nf identlality, has c'Dmpiled a set of case incidents from the psychiatric area * 
illustrating these leakages • Among thejj aire the following three fexe^pl^^s i 

1. ••A* patient, the wife of an .employee covered by a group contract required 
intensiye' treatment because of extreme emotional decompensation. /.When her husband ^ 
filed a claim for the cost of treatment, he was told that the employer would be 
informed of the claim^and would be required ta increase premium payments on all 
employees.'. .The physicism was dissuaded from following up on the ^case by bpth 
the ^usband and the wife for fear that the husband would lose his 'j,ob. The patient 
became worse*** . ^ . / ' 

**A schizophrenic patient received electric shock treatment in a hospital* 
a,nd was able to return to work. The patient was net *told the actual diagnosis* 



because she Was still in a fragile- state .The hospital s6nt a report ot the . 
hospitalization, including the diagnoses of schizophrenia and an account of a 
suicide attempt to the insurance company .which [in tur^ sent it] to the em5.1oyer 
under a group contract coverage, Bacl?^.at work, the. patient f ound. that her 
fellow employees knew all about her illness:* ^ [She] became paranoid towaird her 
physician and terminated treatment." 

% **A, psychiatric patient inquired from the insurance compaJiy whether 
'-^Hnf ormation would reach the employer atnd was assured it would not. The entire 
therapy was damaged and the patient became worse when the employer disclosed 
knowledge of the treatment ^nd othef factors. The Medical Director of the 
National [insurancej company involved. . .wrote t 'We are obligated to tell the 
employer becs^use he pays the premiums.'" 

In the summary of the Blue Cross claims review^rocess, i1; was noted thalT 
mental and nervous conditions were usually not ^.pproved at Level One, and that at 
the Level Two and Three*^ stages, the 'company generally called for further medical 
information, sometimes i^ncludin^ the patient's entire medical record. This project 
received half a dozen letters from doctors concerned about such demands for detailed 
data in insurance claims processing. One was from Dr. Wilson C. Rippy,Jr., a 
Tampa, Florida , psychiatrist . 



"My practice of child psychiatry is somewhat different tHS^ other practitioners 
a result of this, my profile as it comes out of the' computed* for Blue^ Cross 
of Florida is quite different from others. . .Despite extensive correspondence with 
[Blue Cross] and many invitations to visit and view the program first hand... [t]hey 
have continued to misunderstand and it sounds as if they suspect the situation as 
being somelfow improper." ^ • 4- 

"In December, 1973 • they requested photocopies of the complete medical records 
[of /2V children's cases]. I .. .wondered" with them if they would really like to have 
their psychiatrists photograph their chairts and send them off ^t of town to an 
insur^ce company. I offered to bring the chsirts , personally and turn them over to 
another physician or group of- physicians ... and then, bring the charts bac*k with me 
at the end of the review.** ^ 

. Dr. Rippy explains that euch a physician review was ^ultimately arranged in 
this particulair case^ but adds t 

"I sjiould point ojit, however that hospital records of patients in the past 

have* been photographed in their entire^ty, sometimes Without my knowledge, gmd s^t 
to Blue Cross; What eventually happens to these records,.! have no way of knowing. 
In view of this, * I have becojne increasingly apprehensive about what I dictate into 
hospital^chart, which of course compromises the chart and makes it difficult 
or committees made up of child psychiatrists '^to get an* in-depth study of the 
patient.,,! really doubt whether agencies or institutions other than physicians 
need the details within the medical chart and continue to wonder why they have 
access to them. I find my patients are aware of this and apprehensive about telling, 
me tilings. . .and I cannot really reassure them that the chart will not be copied or 
that the information^ somehow will not get out." " '^^ , ^ 

- * . . ^ 49 ' . • 
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A similar letter came from Dr. C, Brandon Quails, Associate Director of the 
HealtK^Team S;fcudy Group at Stanford University Medical Center in Calif ornia, 
He wrote i ' * • 



"Enclosed is a copy of a recent communication from an insurance company, 
in which they asked to film our medical records. One of our patients- had signed 
, a standard release of informat ion form used by insurance companies and Subsequently 
a representative of ^Micro-Reproduction "Services visited our offices to microfilm 
^all the ]3atient's records. Needless to say, we refused such access,,. The 
repre'sentative was not easily put off and tried to, pressure one 'of ou^ staff for 
access to the patient's file. We subsequently contacted the patient and explained 
what had happened. The patient) was quite surprised, because' he had- no idea he 
was granting complete access t J his medical* file as part of his application,,, 
and he was much relieved that i/e had not divulged any information,,," 

*'*More generally, we strenuously object to the wholesale reproduction and , 
release of patients • "files. Since we are a psychiatric clinic, this kind of request 
is a double affront to us,' given the sensitive nature of the information imparted 
to us by our patients* >We strongly feel that third parties should' have access to 
the minimum amount of information necessary to complete their services, rather 
than to the maximum amount of information,,," • 

' Because doctors and patients ha^e these concerns about the details of medical 

conSitions being sent to service payers, individuals entitled to reimbursement / 
sometimes do not file claims when socially stigmatized conditions ai;e present. It 
has been reported that many women arfi not submitting insurance claifiis or-ftbortions 
even though these are now legal. As one observer explained* "Social acceptance of 
abortiori'is 'still mixed, and even those who support the' principle of the right to 
choose may be less supportive to i^ediate associates undergoing abortion. At any 
rate, the woman patient may not wish to 'put work-based relationships, to this test; 
even ^employment may be perceived as ^^^"S in jeopardy,"^''- 

A similar situation has been reported with regard to claims for psychiatric 
treatment, Benjamin Lipson^^^ insurance^ underwriter in Boston, whose firm 
specializes in placing "di^icult" risks, has conducted'^'surveys and studies of the 
effects that current health arid life insurance practices have on individuals, in 
.a recent speech on "Psychiatry and Underw^riting, " Lipson declared: . 

"Gun-shy is one way^o describe the psychiatric patient who pays f o^ benefits 
normally covered by his health insurance because he is frightened of a breach of 
confidentiality, A Maryland psychiatrist reported recently, for instance,* that in 
the six years from I968 through I973, patients of his having Federal Employees 
Health Benefits Insurance fwith Blue Cross paid amounts ranging from $11,950 in one . 
year to $13,500 in another year for psychiatric care that otherwise would be 
covered or defrayed by their insurance. In 19^^. during only the first ten months, 
the ^figure for this one psychiatrist's patients came to $18,400. The doctor ' 
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estimated that in' the past 'ten years, his patients paid at least $150,000 out of 
their own pock^s needlessly, ^nd these are not isolated cases." ' 

• . • . < 

^ In response to the mounting concern about the confidentiality of service payers 

' medical records, some of them have begun to re-evaluate their procedures. The 
National Association of Blu^ Shield Plans, for instance, adopted a formal policy on 
"Guidelines 'on Preserving Confidentiality of Medical Records'* in September, 1975.-''^ 
The guidelines warn of "the potential threat of indiscriminate kcce^s to, and 
releasing of, sensitive patient data,*' Medical information should not be released 
without ^ court order and when there is a court order. Blue Shield "should release' 
only the; specific information requested.** Medical information used for research 
or utilization reviews must not "identify the patient, subscriber* or physician." 
The guidelines call'for restricting access to <»the least number of people necessary" 
within the Blue Shield organization, and for orientation and training programs which 
emphasize the sensitivity of iT)edical recdrds and the need to maintain their 
integrity. Perhaps most important:, 

*'Plan employees should seek only^ those data necessary to adjudicate a claim,- 
case or utilization patterns, and profiles. For exatnple, if the Plan needs only a 
discharge summary or consultation report, it should not ask the hospital or 
physician for the entire record. To do so not only creates storage problems, but 
also places unnecessary burdens on those mecJ^ani^ms which are cieant to 'insure 
confidentiality . " 

k 

Government Programs ; 

Alfltost all of the 2i million Americans over 65 ^re covered under one or both 
of the Medicare programs. More than half of these have supplementary pi^^ate 
insurance as well. Medicaid provides somje medical expense coverage for millions 
of low-income patients. Each y^ear^ social security disability payments go to more 
than three million workers.. HEW also provides funding, on a partly matching basis 
with the states, for a broad. variety of special health services: for children, 
the mentally retarded and blind, the emotionally disturbed, the physically * 
handicapped, alcoholics, and drug addicts. ^ In st'ddition more .than 60 million full- 
time workers are covered under Workmen's Compensation laws, • ' ^ ' ^ 



For those over 65 jf/ho are covered by Medicare, once eligibility ofJ^age. has 
been established,, the program does not need to collect information on whether an 
individual is a poor health risk or a po6r financial risk. The gjDvernment's ma*jor^ 
concern is to make sure that the medical procedures it is paying for are. in fact 
perfc^ed/ and if performed, are necessary in terms of sound medical practice. 
This concern for fraud is directed not at the patient, but at the doctor, or 
hospital being reimbursed. Misuse and fraud by , doc tors and health care providers ' 
running into, the millions of dollars is often cited as a chief reason'for the 
astronomical costs of government funded medical programs. Thus, government programs 
use the patient's medical record for utilization review and quality care assurance, 
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which will 'be discussed shortly. 

Medicaid an4 several^ of the special he^ilth programs listed above require the 
establishment of financial need by participants. A new amendment to the Social 
Security Act, Title XX, went into effect in October, 1975.^^ It requires the states 
to scrutinize closely the -eligibility ^ of participants in the Aid to Families with 
Dependent Children Program, and the Supplementary Security Income Program (the aged 
'and the blind). State administrators aire encouraged to cross-check these two 
categories against the records of individuals in other government programs such as 
Medicaid or state -supported correction services. Thus, for example, the 
administrator of a program for crippled children might check the eligibility of a 
particular child by checking the records of' the juvenile justice system to make sure 
that the- information on the latter record is the same as on the application for aid 
for the handicapped child/ 

The states may alsc>' check eligibility through other sources. In Connecticut, 
for example, the' applicant incom'e dis^umentation is checked with the records of 
the Connecticut Depairtment of Labor, which collects a quarterly report on wages 
from each employer, Buf^ore than ^come documentation is required to participate,^ 
in the medical b'en^i-cs of these programs,. Ftrm W-2000 of the Connecticut 
Defiartment of Social Services requests name,^ address. Social Security number, date 
of birth, ethnjd^ edii^^ional, religious and marital data. Applicants are not told 
that beyorfd identifying name, address and Social Security number, and income 
information^ the other data are optional and nojt;^ required by federal regulations. 
Nor are they told 4iow this information will be used. , • 

Most state and federal programs monitor medical aid to detect fraud, or as 
President Fo,rd put.it when Title XX was signed into' law, -^to get the chiselers off 
welfare," At least one government agency disbursing medical aid funds went far 
beyond this:. Und^r the California Short-Doyle Act, county health departments 
^dlsbur&e supplemental funds to psychiatric clinics on behalf of those patients who 
canr^ot^ ^f f^rd private practitioners,^^ The Marin County Department of Health 
Services demanded ^t hat psychiatric clinics receiving these funds supply an analysis 
of ^ach patient's problems, including the patient's living situation, .whether he or- 
she had difficulty in social relations, and answerg^o qua^tions about therapy such 
as "What does pat lent/ expect to gain from therapy? What is patient willing to 
c^angeV What is patient willing to undergo to bring about change?** 

Although;the California Short-Doyle Act required no such information, the 
Marin County Departrp^^nt of Health Services 'told the county psychiatric clinics that 
i1/ would withhold the funds if the questionnaires were not completed and i:^turned. 
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UTILIZATION REVIEWS AND QUALITY CARE ASSURANCE 

Utilization "review is a system by which hospitals, and outside monitoring 
agencies attempt to determ5nie how the hospital's facilities are being used, go 
tljat administrators may answer such questions a^: are the overail -facilities 
adequate tp the patient loadi are some facilities being underused while others 
are being overused; what is the normal length of hospital .stay for a particular 
illness or.-' operation §nd how do stays in a Specific hospital compare with these 
norms I what is the staff-patient ratio and is it higher or lower than the norm,^-' 
Quality care- assurance is the related examination of whether the treatment 
prescribed for 'the patient .is appropriate," and whether the actual delivery- of that 
treatment is along professionally acceptable lines. Both kinds of reviews are 
needed by hospitals so that they can plan the most' efficient use of their facilities 
at the lowest costs"; to service payers so that they may control the costs of 
medical cairei and to patients so that they may be assured good quality medical^, 
care under good physical conditions. , ^ " ^ 

Utilization and quality pare assurance reviews aire conducted on .several levels 
yhich sometimes overlap. Many hospitals conduct their own utxli2>ation reviews, 
Sometimes they review their internal operations alone, and sometimes they compare 
themselves to other hospitals ^so . they can adjust their tjwn practices against^ the 
norms . 



of 



,A variety^ of private statistical review services sire used by hospitals abound 
the country for statist^al profiles against which to compaire their own performance. 
The largest of theWy^he Professional Activity Service, has each participjatingl 
hospital extract 50 or 60 items of information from patient records in ^der to 
.prepare its reports. ^ The Service covers roughly 30^ of the largest sh^)rt-term 
general hospitals, representing perhaps hjfo of adm'issions and discharges in the ' 
country. .The reports prepared Professional Activity Service and the eight or 
ten simirar systems for hospitals do not contain identified patient information but 
are statistical in character. 

The Joint Commission cm Accreditation of Hospitals reviews hospital performance 
to make sure that hospitsds^ meet certain standards in physical plant and patient- • 
staff rati-osi to deterrffine that patient records are current and comprehensible i 
and/to see that cornet procedures We followed as to drug orders, discharge 
summaries , e tc . 

State apQ local agencies responsible f op* supervising h9spitals monitor 
sanitary faCcilities and compliance with building, safety, and fire codes. Some 
of them/Use patient records to review hospital costs, medical projcedures and length 
of s;^. The Public Health Service also examines patient "records for its fitfinual 
'^^ital Discharge Survey. Selecte^^ information is Extracted from 250,pOO patient 
iles in 690 hospitals for this purpose. 
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Blue Cross and Blue Shield set norms on lengths of hospital stay for particular 

illnesses and procedures, and of'^he cost of physicians* services in hospitals for 

givqn procedures, based on actuarial studies abstracted from their, subscribers' 

29 ^ , 

records. Since the *'Blues" can withhold reimbursement to the hospital or 

physician if they, find that the norms are vio'lated without good reason, this ^ 

constitutes a powerful form of utilization review and quality care assurance, 

. Professional Standards Review Organizations . » , * 

Since the mid-sixties, federal and state agencies responsible for Medicare and 
Medicaid programs have required hospitals to perform several kir^ds of review, 
including, patient record review, to justify the %yip^ of care provided C^.g. inpatient 
vs, outpatient) and the length of time a patient stays in, the hospjTtal,-^^ , Fiscal 
interme;iiaries for Medicaire and Medicaid (often Blue Cross, Blue Shield or private 
health insurance companies) have been conducting claims reviews in which the need 
for hospital care is evaluated after the fact, and a decision is made on how much 
of a particular claim the government will pay, ^ 



By the early 1970*s, the soaring costs of Medicaid and Medicare— in some a^eas 
hundreds of millions of dollars more than was originally estimated--led Congress to 
create a special structure for reviewing the costs of medibal care under these two 
programs. This was the genesis of the Prof es'sional Standards Review Organizations 
(PSRO), brought into' being by Title XI of the Social Security Act in 1972 (Public 
Law 92-603).-^^ The PSROs are designed to detect ^raud and misuse of facilities by 
health care providers— physicians and hospitals— and to assure that proper standards 
of care are secured under public funds; 

The format of the PSROs-.-physician-staf :^ed^and physician-directed commissions 
undtr the aegis of state Medical societies-nfcas suggested by .the American Medical 
Association as a counter-proposal to head off monitoring of; medical^care by 
government officials, especially non-medical personnel. Even though the medical 
profession controls this policing function, some physicians' groups and hospital 
organizations sought to enjoin the operation of the PSROs as an unnecessary 
government interference witb the practice of medicine. In November, 1975, the 
Supreme Court rejected this airgument, and the PSROs are expected to become fully 
operational by 1976, as originally scheduled in the legislation. 
^ ■ ■ . ' 

Ufider the legislation, the Secretary of HEW is authorized to designate 206 
PSRO districts throughput ,thenPcountry,^ By January 1, 1976, and to establish 
"cWrtional contracts" with /"a qualified organization**— that is, a"non-profit 
.professional as^ciation which represents a substantial proportion of the physicians 
in each are^. 'These bodies are to set up the machinery for 'and to administer the 
program. If, no n9n-profit association applies,. HEW is empowered to contract with 
any other organization, a hospital, for example, ta administer the program in a " 
given ai*ea. y 
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The PSROs initial function is to provide utilization review of hospital 
services", first by pre -certifying the particular hospitals for Medicaid and 

J edicare patients, and then by regular re-certification, ^gilSey -must also review 
he quality of care within the institution', making judgments as to whether particular 
procedures or tests or 'operations are warrante^d for the conditions specified, and 
^determining whether the procedures warranted were in fact delivered. Ultimately, it 
is contemplated that PSROs will review all government-supported institutional ' 
care? mental health facilities, skilled nursing facilities^ and intermediate care 
facilities. They may some <^y review non-institutional care supported by the ^ 
government, including outpatient clinics and medical home, visits, * 

Exactly how the PSROs are to conduct review? in each area is left flexible, -^-^ 
Where a hospital has evidenced its capability and desire to run its own review 
Proerram, the PSRO^can contract with the hospital to do so, and in this case, the 
PSRO will monitor the monitor. Where a hospital is not qualified or willing to do 
its^own review, PSRO may either -assemble a professional staff to perform ^e review, 
or,.it can delegate this duty on some other* basis. 

The legislation creates a Plrofessional Standards Review Council in each state 
which has more than three local PSROs, (Massachusetts, for instance, has five local 
districts). This state Council will be' composed of .one representative from each 
local. PSRO, four physicians, ,and four laymen selected by the HEW Secretary as 
public^ representatives. Two 'of the latter are to be recommended by tjfe State ^ i 

go^err^br, Th'fe State Council will review the Jocal PSRO performance. Over the 
state Councils is a National Peerf Standard Review Council, consisting of 11 
physicdang appointed by the Secretary of , HEW which reports to HEW and the Congress 
♦ on how the whole program is working, * - 

•While spepif ic administrative arrangements may. differ considerablvj'rom one 
PSRO to another, an example from a Northeastern PSRD may be generally illustrative , 
This organ'izatipn covers 1,400 physicians^d osteopaths,, and 22,000 Medicaid and 
Medicare 'hospital admissions each year, 

4flost of. the hospitals in. this region will be allowed to do their own 
certification ^and length of stay .reviews , Specially trained nurses extract the 
patient da^ta needed for certification forms. If the admission of>^ a particular 
patient is certified, a projected length of stay will be decided upon, and the 
patient and the physician will be told that expenses will not be paid for beyond 
that length of time unlees the case is examined at a later time^'and re-certified, 
Cppies of the certification forms go into the patiellt's file and to the PSRO, 
Difficult cases are referred to pSRO physicians for d'ecision, 

^Hhen the patient is discharged, medical record technicians may extract - 
information for a discharge summary, a copy of which will be sent to PSRO. Working 
from this information, and occasionally from additional , patient file information 
from the hospital, the PSRO wj^ll do medical evaluation studies and maintain profiles 
on patients, ^physicians and institutions, . ^ ^ * 
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According to the director of this PSRO» it is not yet clear exactly how the 
patient and physiciaji profiles will be used, although it is assume^ that physicians - 
will be alerted if their practices depart substsmtially from those of other 
physicians in their region, as for example, how freflueittly they perfdrm surgery 
for a given condition. One of the considerations here, according to the director, 
will -be to "avoid stigmatizing individual physicisms among" their dolleaguesfby ~ . 
directing most of the -educational efforts at the entire staff of the hospital.*' 

Since the PSROs We not yet fully operational, several aspects about their, 
role are still to be developed, Th^e aire conflicting opinions about when and lf 
the PSROs will eventually replace totally the present* Medicaid and Medicare 
evaluation programs, some of which, as noted earlier, are now conducted by a 
variety of fiscal intermediaries.-' Nor is it established exactly what^ kinds of 
mat^erials the PSROs will collect for their reviews, what sort of patient record 
review will become stsmdairdi zed, and whether or not the PSRO will virtually compel 
the creation of state-wide or regional data banks, ♦ 



CONCLUSIONS 



This .chapter* has highlighted several features of record-keeping a^i^^data use* 
in Zone II, The personal medical data used by service payers and care reviewers 
does not come directly from patients but from the records compiled and maintained 
by primary * care providers, ^ As a practical matter, general consent forms and the 
legal doctrin^ of implied consent result in the patient unknowingly surr,endering 
control over what is furnished to Zone II organisations and. how it is used. 



Within the past year or two, medical spokesmen and civil liberties grouj|p^have 
'voiced concern abcJut the broad scope of Zone II demands for patient information. 
Among the questions they have raised are: Whethe)? Khe amount of detail sought is 
necessary for the functions performed; whether the data is adequately secured 
against unauthorized third party access; and what the justifiction is for retaining 
patient" data for long periods in identified form, ^ ^ 

K ' 

^ These concerns have begun to create a recoft&ideration of Zone II needs ^d 
practices among insurers and care^j^eviewers themselves *as well as medical societies 
and various government agencies. Among the possibilities being explored are 
whetJfer removal of patient identifiers from many of the payment or review^ processes 
is desirable to minimize the dangers of improi>er disclosure; whether potification 
to *patients of how insurers process their claim data should be required, with rights 
of access provided v^en the patient requests it; ^and whether there* sire ways of 
lessening the amount of personal data required for sensitive Zone II activities' such 
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as payment for psychiatric treatment or stigmatizing physical conditions. 

It should be underscored that what is^ being re-examined is the -procedure , for 
protecting, and limiting the information supplied, and not the fundamental idea that 
there is a legitimate need^ in Zone II for identified patient information; It is 
almost universally accepted that any health care system --whether public or private 
or a mixture of the two-^-must know who the patients are in order both to pay for ' 
their care and to guarantee that this care |ieets professional standards at^ a 
''reasonable cost* ^ 

V ■ ~ 
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CHAPTER 3. ZONE III - SECONDARY USERS OF PERSONAL MEDICAL DATA 



This chapter traces how secondary us&rs of personal medical data - organizations 
not directly providing health carfe, paying for it, or assuring its proper deliyery • 
obtain such information fon various business or governmental purposes / and how they 
use it once they get it. as we noted eairlier, the outwaird flow of medical data 
to Zone III has enormous impact on people's lives. It affects^ decisions on 
Kether .they are hired or fired, whether they can secure' business licenses and life 
insuramce) whether they are permitted to drive cars, whether they are placed under 
police surveillance or labelled its security risks, or even whether they can get 
nominated for and elected to political office. . Each of these decisions— and many 
more — involves a balancing of the individual *s claim to privacy with other societal 
g03^. The survey that follows catalogs existing practices, "^d" also notes the 
continuing re -e valuation of these competing values that has taken place over the 
years, especially during the past decade of , major changes in social and political 
values in the United States. 

CREDENTIAL AND EVALUATIVE DECISIONS 

Life Insurance 


The decision-making process in life insurance underwriting resembles that in 
health insurance. Approximately 24^ of the life insurance policies in force in 
1972 were on a group basis and required' ng health information from the applicant^ 
Still others are called "non-medical" because no physical examination is requirea. 
Many companies write insurance for younger people for up to $30,000 without 
requiring either a medical examination or ordering a Re taifi •Credit report. "Non- 
medical" may be a misleading term, however, since companies do assess the h.ealth 
information provided on the application form, and may order a check with the . 
5'^edical Information Bureau, an industry-run medical information pool. 

* Since the Medical Information Bureau (MIB) is the chief source of th^e life 

insurance industry's health information, a brief explanation of its operation may be 

2 " " 
helpful. MIB was established in I909 by large insurance companies for the purpose 

of supplying medical ^'eports about insurance applicants to its 7OO member life^ 

insurance companies. . 

These member insurance companies ar^e the source of the raw data from which 
IV^IB compiles its final reports. The reports to MIB draw on the life insurance 
compamies' sources of information^ such as applications, physicians • -and hospltaj. 
records, and previous claims. When an "insurance related" medical cdndition'Hf 
noted, it is passed on to MJB throu^ a system of more than 300 separate codes \ 
which can produce a general picture of the applicant. Family history codes permit 
the listing of hereditary diseases, TB, and mental disorders in the applicant's*, 
family. Blindness and other permanent disabilities 'are covered by other codes, 
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as are all major infectious diseases, alcoholism', drug^dependency and injuries. 
Until recently, codes for -reckless driving," sexual 'deviance and social 
maladjustments were included, as well as codes about financial condition, ^d . * . 
participation in hazardous sports, MIB no longer requires member. firms to report 
information under these codes. MIB officials state that »*all reports ^to the MIB 
are automatically expunged seven years af^er the date they are reported, 'in this * 
way, reports made in the dist^t pas\ are' no longer available for underwriting 
purposes; and- a mechanism is provided for a person to start afresh ^ith a clean ' 
slate/* • . . ^ 

A typicaa- Medical Information Bureau report might look like thisi "11X039 INDi 
DrtA UAP72; 258ZMC-340." From these codes, the insurer c^ tell that this 
.•individual, a physician living in Indiana, was born on August 11, 1939, an4 that a • 
■report yvas received from a medical source on April ik, 1972 that he Kad a 
psychoneurotic disorder, with two or more episodes of this problem within the last' 
five years. The report also shows that his cardiogram is normal. Had it not been 
normal, specific values would have been reported. If there "h^d/been psychosomatic 
complications accompanying the psychiatric prpblem, these woi^ld have been noted.- 

■ MIB maintains files on 11 million indi-viduals . In 1971, the Bureau handled'. ' 
19. million requests for informatiQn, returning over 500,000 reports with adverse 
medical or other information (a little over 5%). , Menrber insurance "companies paid. 
$9 million for these reports- in 1971,, and se'nt'2/2 million coded reports t.o KIB 
describing the health problems of applicants, or in the case of some health insurance 
firms, claimants, too^. . ■ . 

In 197'f. KIB a^Jopted nfew rules tO'TJting it into coirfonnity with the Fair Credit ' 
Reporting Act. insurance applicLit is now told by the insurance company 

that some of the information gathered V^bout him may be submitted to -the T.-IB: 
Member life insurance companies are also required to obtain authorization from the 
applicant before the. company is permitted to query the MIB computer. Applicants 
are told that they may have access to. the information about themj and that ^y 
inaccuracies ca.) be corrected. When ^request for access is received, IWIB arranges 
for the company that made the report to send the information - to the applicant or 
policyholder. Medical information -is not s|.nt directly to the 'applicant, but to- 
his physician. 

P«r .deciding about larger policies or applications from older people, the full 
range of information sources may be used. In 1972, almost 8 Jnillio'n' investigative" 
reports were completed for life -underwriting by Retail Credit. Hooper-Holmes and 
the American Service Bureau.* ^ One review of life un^lerwriting procedures indicates 
that firms do not check hospital reiotds ver^ often,- even when they have a release 
from the patient, because it is expensive to do so. 
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^ In 1972, ^almost 85% of life insurance applications were approved at standaird 
rates. Of the 500^000 applications denied that year, 90^. were turned down for 
health reaspns* Roughly 4% were approved but the policyholder had to pay higher 
rates for the fiollowing reasons t,^ heart disease^ 35^1 weight problems, l7%i other 
^medicad r^^ons, 29%; occupation^^j other reasons » 10%. ' . ^ ^ 

It is worth noting that very little use is made within insurance companies 

th^selves of the information gathered during the underwriting pr^'qCdsa* Lawrence 

s suggests that relatively little information moves from one line, say life 
/ •> 6 if ' 

ranee, to another, say health insurance, within the same firm.*^ But botb medical 

hearsay ^and reliable medical reports aire used olitside the insuriig.rirm once the* < 

underwriting process is completed. Life insurance companies j>ass 'on, to the Medical 

Information Bureau, in the form of general codes, adversfe informatpLon about 

applicants received from Retail Credit, other companies, physician 'statements and 

medipal examinations. ' . , - ' ♦ ^ - 

^ — 

Automobile Insurance » >A 

One feature of autp insurance is distinctive r €vll staples r-equire individuals 
who own cars to cairry liability insurance. Mandatory insurance requirements have 
resulted* in a complex system of "assigned risks" under which everycJne is supposed to 
be guaranteed at least the minimum lever! of personal'' li^bilirty -coverage-, but at' 
higher rates. ^ A study conducted in 197^ by the Federal Insurance Administration 
of the Depairtment of Housing and Urban Development showed that ino s^ite of the' 
mapSafory insurance requirement, at 'the latest count (19^5?), 20% of the r\ation's 
drivers were atill not \pvered by ^piy insurance,^ Furthermore^ of , the four' million 
Slrivers in ^'assigned risk" state pools, who peiy aUpiost twice as much for automobile 
pliability insurance, 3»3 million were "clean** risks — that is, they had not liad an 
^accident\f^thin three years, pf these, 2^7 mill'ion had neither had an accident nor • 



a driving vioi^tion on ^heir records within th^ee yeairs. The, study gives >io reasons 
why apparently lo^risk. individuals are refused conventional insurance, but tfeorge 
K^iJ^rnstein, Federal Insurance Administrator, offered some* possible ex^lanat-ions t 

• • / * \ 

•'Applicants might be refused because a company does^not want to "* 
MriXe Siny mbre insurance in a certain area. P^haps tije company doe9 . 
not want to give an agency any more business. %aybe the applid^mt has 
been reported to keep a me^sy-^hQuse. ^^r perhaps an individual lives in 
the wrong neighborhood.** ^ ^ • '* * I : 

WhilQ relatively little, has been written about dutomobile insura^;ice underwriting, 
it appears that healtK information plays some role in determining what rite an 
individual pays. Whexher an individual is placed in an assigned* risk pool, for 
fexample, may dex)ena^on a disafiiltty which oafght impair 4riving, or oA" an* , 
investigative r^i^OTt alleging the exde^sive use \pf alc9hol.j The Federal Insurance 
Admipistj^fition report notes one insurance plai^ in which a* family;}^ premium would ^ 
inciifease hy^% if the father "suffered from moderately high blood pressure." 



^ other- factors » however, are more important than health records, according to 
the FIA's report: age, geographical location, race, claims history ^d driving 
violations are probably the most imporfant reasons for forcing applicants -into the 
assigned r^k category. The Amerrican Insurance Association reported that less than 

of 1% of its members' cancellations or non-renewals in 1 96 8, were for health* 
reasons,?"^ * ** - ' 

A dramatic example of a breach of confidentiality of medical Records 'in an 
"accident/casualty setting was revealed .early in 1976, In Denver, Colorado indictments^ 
were brought against Factual Services Bureau (a 27^^ea;: old, private detective 
agency with operations throughout the country), several of its employees'; and one 
hospital employee for illegally obtaining \nformation from hospital medical records. 

The information was allegedly securew^ f or casualty insurance ^companies and 
their attorneys fo> use in challenging claims against the companies. The most 
common means of obtaining the inf ormation ,was for a Ractual Services Bureau employee 
to telephone a hospital pretending to be a physician from another hospital who 
needed the data to treat the patient whose records were on file, (One of- the 
charges was criminal impersonation,) \n Assistant District Attorney, working on the 
case noted that it was easy to obtain hospital infoj^mation without authorization """^ 
because security procedures are geared to the assumption that" all inquiries are 
legitimate, and any person calling is who he claims to be..^ y 
^ ^ As of March 1976 -the term of the grand juryHfhat brought -the indictments was 
extended for two more months and the investigation wae continuing, yfi additio^,^ " 
investigatiofl^ere. begun in other st^ates with the thoug)^t^ that this- may have, been 
a normal operational procedure for all of the compan^^s branches.^|| - 



* Rocky Mountain News, January 1^, 1976, ^. %!, a^ld telephony conversations with 
Denver Assistant District Attorney Peter Bornstein, January 22 and March 3, I976. 
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Employment ^ # 

To some extent, the role of health information in employment decisions follows 
the^ law of supply and demand , in the labor market. The more plentiful the labor 
supply » the more rigid the health criteria— along with other criteria — become. 
Similarly, the health standards that are sometimes ,set by employers aire often not * ^ 
related to their goals of reducing absenteeism, increasing worker performance^ and 
eepin^ group health insurance premiums low. TheyNSometiraes appear to be an 
xercise in Selectivity for the sake of selectivity itself. 

/ * * * 

'For example-, *a Veterans Administration, poll of company doctors recently 

discovered that not only medical problems like TB, diabetes and men;tal disorders 
disqualify many job applicants,' but "even patients with mild illnesses, which may 
*not increase their morbidity or mortality, are being denied work.^^ The criteria 
u^ed for determining employability appear in some cases to have little relation tcy 
modern medical judgment." ' ^ 

Discrimination against those who have had psychiatric caire has been -particular 
focus of protest. The 'American Psychiatric Association's Task Force on 
Corifidentiallty reports receiving many complaints about patients being denied 
employment or promotion unfairly because they have had psychiatric treatment . ^ 
■■^*)ne" schoor system7 irhey-report, :~routinel^ employn^t^'to individuals who have 

-^any hisfory of therapy or psychiatric care. The VA study mentioned abc/e found 
"^^^ -^^^ company physicians resjLonding said their firms would not hire ^ 

a >erson who, "is currently under psychotherapy" for any position almost, - 
reported that tJ^ey would deny employment^to an aplicant who had previously been . 
hospitalized for a mental illness, but was not psychotic. In a recent case in 
New Jersey, an applicant for the ^police department was rejected because hi^ military 
record showed an o;Ld psychological treatment entry. The impact on the job market 
of such restrictive employment policies, can be gauged when it is r^ecalled thaj 
almost 3 million people aire currently in psychotherapy, fi^ccording to a 1975 report 
issued by the National Institutes for Mental -Health. 

The extent to which health information is sought by employers — often at v 
considerable expenses-demonstrates how Implprtant a part it pl^s in employmerv*^ 
decisions. Health information may enter tfet decisipn-making process from at least 
six different sources: on the a:pplication form, from company and prjjr^e 
physicians, from invest^igative r^orts by firms such a^ Retail Credit and 



government security agencies, from insurance claims or from the insurance cairrier, 
from contacts with previous employers, and from U,S, military separation papers ♦ 

Many .application forms demand information abou.t the general state of" the. 
applicant's health and whether or not the applicant has ever suffered from a mental 

.^disorder, received psychiatric treatment, drinks, or uses drug;s. Sample surveys 
condi^ted in 1964 and I965 by the National ^Industrial Conference Board, a management 
society, show that more than' 70^ ofy^fie manufacturing and non-manufacturing firms 

^studi^^ require a pre-employmeirt-'piiysical for ajt least some, applicants , 

The -federal governifTTnt investigates many applicants through the National Agency 

Checks and Investigation's, program of the FBI and the lise of -"full field" 
' 17 

investigations. The full field investigation has as one' of its goals the 
assessment of "mental stability,** and investigators often interview school and 
private psychiatrists. While full investigations ar^ normally conducted onlyl-for 
higher government posts, or in situations where there aire "national security** 
concerns, s-orae government agencies order them whenever they get information that the 
applicant has had , psychotherapy or may be^a homosexual, even though he or she may be 
applying for a relatively insignificant job. There alao have bjeen charges that if 
an applicant has had psychotherapy, or is a ho^^gsextial, the job fpr which he or she 
is applying may suddenly be reclassi^ed as requiring a security clearance, as a 
device for disqual-ifyin'g-^he-~app^llcan1r^or-irt. ' — — — 

7 • - . - 

In a report in the American Jour^ial of Psychiatry, three psychiatrists describe 
the procedures followed when the government orders psychiatric evaluation of an 
applicant for' security cleairance,^^ • ' . * 



I ' Applicants are not routinely exfimin&d by a psychiatrist. The most 
common reasons [for requiring the examiniation] are that he was once a 
patient in a mental hospital, was discharged from the armed forces because 
of -a psychiatric condition, or had been under official surveillance 
t because of some abnormality , of behavior.* ^ i L 

The relationship of the applicant and the psychiatrist is not 
that of patient and physician and no traditional confidentiality of 
communications arises. The psychiatrist should tell lihe applicant > 
tjiat their re^aji^n^ip is" net confidential and that all information,., a^* 
/ may be re ve ale/ to. th^ government. ♦ . [Tjhe interview and examination ^ 
are voluntary/ However, a refusal to furnish relevant data may prevent ^ ' 
any kind. of aVfinal judgment on the Individual, in which event, * 
processing of Thq' application for clearance would discontinued," 

A somewhat different er^t of cii^cumstances arose"^ in an actual case in which an 
applicarjt for security c^arance an^swered "no^ to the question on the application 
formt ^ -Have you ever suWered from mental illness?-^^ It was subsequently revealed' 
that some years^earlier he iiad seen a psychiatrist for" a brief period. The 
government claimed he 'had lied on. the form aJid attempted to fire him. The applicant 
claimed that viaitiJig^a psychiatrist was not evidence of mental illness, and that 
his^answer^ had ^een truthful. The government -fijien, required him to have a \ 
psychiatric examination, to which he ^greed-l ^d in addition to, sign a release which 
would gite the government access to' the private notes of the psychiatrist who had 
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treated him, earlier/ Vhen, he balked at tlfts, he was fired*/ Ultimately the U.S.' 
Court of Appeals 'upheld the government's right to fire him, but remarl^ed that the^ 
-government's practice of requiring access to his private psychiatrist's notes was " 
not a good one, and suggested that the government re-think its procedures. 

As noted earlier, for many years the U.S. military services included code 
numbers on veterans' discharge papers that labelled them with any one or more of a 
-number of derogatory '"mpdical- terms. While the Services' have promised to stop 
doing this,^ veterans must affirmatively !reque,st to have their discharge' papers 
changed to omit the.se code numbers'. Since .the majority of veterans probably still 
do not know the meaning- '^f the numbers, hundreds of thousands of them are carrying/ 
around this adverse information and disseminat^«g*4A to employers' files, ^ ' 

The insurance claims process also' gives employers health inf ormation' their' 
employees. This happens either because insurance companies supply it directly to 
the employer as* the payer of (the health insurance premium, or when. the personnel 
depsLTtment of the company actively monitors claims. , ' 

In 1970, the^Rfetail Credit Company completed more than one million repor;ts 
on job applji^ants and candidates for promotion; for < these, investigators gather 
health information from former employers, neighbors, personal references" and 
workmen's compensation files. 



^ In hearings before a House Committee irv I968, Retail Credit supplied a 
fictitious model. report, fhis noted that the. applicant had a period of ynemploj^ment 
caused by k ''mild neryous' breakdown*'' for which his physician had recommended a 
period of complete rest. Under the J^eading of •'Health Habits** the report. reads: 



••lY.r. Bowers has good general healtjf with the exception of a nervous 
^ disorder tf^at has ^hown up previously when he has been under pressure • - 
This usually results in stomach discomfort. Kis physician has diagnosed 
this as 'nervous tension'.^ He has had this condition for the past 15 ; 
years known. Subject has not suffered a relapse of nervous breakdown, 
however, he will take medication prescribed for relief of tension when 
-he feels it necessary, . * * • * • , 

' ' ** ^ 

Mr*. Bowers is a social drinker, taking* a maximum of 2-3 mixed 
driinks during any. one occasion at pai:,ti^-an^ when friends visit at 
his home. He has never drunk to any degree of"'exc&s and d6es not use ' ' 
drugs other than medication prescribed for* relief of nervous tension.** 22 

• #^ » , 

*** " * - '» 

The report notes that the health ' informat]^ on was ^obtained .from his present' and 
a former employer and **personal associates.** * ' • ^ ' 

No^ jll Retail Cr^d if reports are as detailed as tlis sp^^STnifen* Some ma/ 
use single phrases :y "spleen problems,** "wife has colitis^ rierves,** "eye in juryfi " 
to describe health ()roblems learned about ,'from the applicaht or from an em'ployer 
or neighbor, " . 
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* ' About 80% of the information in Re^tail Credit reports comes from the 4$ million 
records stored in branch offices. Where the requested name is not on file, or the 
material needs to be updated, investigators interview the applicant and his neighbors 
and employers, ^ 

^ , « 

In 1974, the Federal Trade Commission filed a complaint against Retail Credit 
sharply criticizing some of its investigative and reporting. techniques , Among 
other things, the FTC charged thati 

'^•l. Retail Credit investigators give individuals the impression that they are 
being, investigated only in connection. with a specific job application or insurance 
application when, in fact, the information about the individual will be kept on 
fileV Retail Credit for future reference by an^ysubsequent customers. Specifically 
as to medical information, patients are given the impression that when they sign 
authorizations for release of medical information, such information is for the 
exclusive use of the- insurance company r ^ocrt or s and hospital^ are also given the 
impression that Retail Credit is collecting information for that exclusive use, • 
The FTC complaint states that- "some consumers would not have authorized the release 
of such confidential information had they known it wouliTcbe .utilized by.,, a 
consumer ^reporting agency-* " ~ • * 

2, RexaH Credit-gives trust oraers-f insnrffljce-companies , employers, Vtc, ) the 
impression that its investigators have personally interviewed all of 'the. individuals 
listed as ^sourcesj^ on their reports,^ and^have^personally observed the home and 

'environment of the individual being investigated. In fact, the, F^TC. alleged, much 
of the information is gathered over the telepl^one, and sometilnea not even 
telephone interviews are conducted^.with the listed sources. .Often site visits are 
not made, even though the report described the hous^ and neighborhood* If 
customers realized how superficial and/or inaccurate* these repoVts are, the FTC 
claims, they would not re^y on them to deny employment or other benefits. 

3, According to the FTC, certain procedure^ in the preparatiori of Retail 
-Credit's investigative reports enco^age- inaccuracy , including^..' . • i ' 

% ' setting quotas for the percentage, of consumer repbrts^t^at mus^^contain 
*derogat^)ry -Information J ^ ^ ] ^) ^ : ♦ ' * i ! * ^' 

o requiring investigative personnel -to /omplete an unreas(|nibly high number 
of investigative consumer reports In^ a lijulted ti}»6j ^ . k ' . 

s ■ ^ i • : * A ' /];.: , 

^, Retail Credit makes it difficult for e'ohsumers tp revi^W.^he cinte^^^ of 
theix* records "by refusiite- to malte'them flvflnahift. ii+ r-^^n^iVav* 




f« conplamt is still being T^eard but%/. L^e Burge, Chief Executive Officer of 
Retail credit (now renamed Equifax) responded publicly to the FTC charges m his testi- 
mony at the senate hearings to consider amendments to the Fair Credit Reoo^t^g Act .2i» 
Ir.Burge defended the Investigative techniques of his company and ^specifically denied 
that It^^sets quotas for derogate information. In his comments on the proposed amend- 
ments, he stated that the present la^ serves consumer needs- for access adeouately. and 
that changes would mjure the consumer. The proposal for advance notification of an 
employment or Insurance investigation, for example, would delay, for both ti.e customer- 
company and the consumer, decisions on employment to the detriment of the Job applicant, 
and might result. Mr. Surge said, in a motorist driving an unlnsured'^car . 



As to the requirement for disclosure of sources of information, Mr. Burge 
responded that if Retail Credit could not promise' confidentiality to its sources 
they would inevitably dry up. He gave»as an example tf.e consumer who is engaged in - 
underworld activity who, -if told the source of an'unfavorable .comment , might 
intimidate or physically harm the informant.. Mr. Burge. added that; such a requirement 
of disclosure would also shi^t off sources of favorable 'comments as well as " •• 
unfavorable ones. 



Maintaining Medical Records in Health-Hazardous Tnrfn'.-H»"^or - 



Medical record-keeping:in employment can be of vital importance not only from 
the point^of view of individuals securing .iobs.but for maintaining good, health on 
the job. -In the last twenty years, scientists have been- uncovering compelling 
evidence that exposure on the -job Ikd .certain widely used industrial products- 
asbestos and Vinyl chloride among them-causes an alarmingly high incidence of 
cancer. One of the chibf problems in controlling the disease is that it u^ally does 
.not surface until twenty or more\ears after exposure. Tbat makes careful medical 
record-keeping essential. Initial-^, the goal oV the managers of the industries . 
that use these products was to pla/ down their connection with cancer, and to this 
end . many companies kept no health reccp-ds at |11. Dr. Irving Seliko^f , one of tM 
leading researchers in this field, trifd to sefure medical and employment records f 
workers .n an asbestos plant after I7 of his private patients died of cancer after^ 
having worked there .. He. wanted to track down the other 7OO worker^ so that'they 
could be ^.rayed for' the disea^. The president of the asbes'tos company told hL 
tnat no -such records were available. • ' r. * ' 



■ Increasing pressure frpm.the medical .profession, especially from articles in 
schol^ly journajls, and from the Occupational Safety and Health Administration' of 
the-labor Department and the APL-CIO Industrial Union Department, forced the 
.asbestos indust^ to permit x-raying_,of workers In jmany pl^ts. But thr woJl^ers" 
were not told why th^y were being x-rayed, nor werj they told what ^the safe Lels ' 
of as^stos dust were, nor that the ^overpment had required " those with the gfeatest 
exposure to wear respirators. Physicians ^and i>tUer health professionals weS. hired 
to examine workers, but their findings were not shared'with the individual workers 
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examined, nor were atmospheric tests shared with their ^medical colleagues. 

|he secrecy of medica^l findings, including the lack of accerss to the ^workers 
to whom the information is a life-or-death matter, brought a^stinging rebuke -from 
Jacob dayman, secretary of' the AFL-CIO Ickdustrial Union Department, in a speech 
, .on the relationship of vinyl chloride to cancer: 

_ "Multi-corporate studies of cancer from vinyl chloride were . " . 
initiated secretly in this country and in Europe,. , Their results 
would probably still "be a secret without the presence of the mass 
media and if the law did not require the reporting of occupational 
disease [the Occupational Haalth and Safety Act]..." 

t * * 

Most often, when charges are made that medical caire and medical record-keeping 

in employment are serving the interests of employers, and not pf the employee/ 

patient, the complaint is about lack of confidentiality of patient records. In 

, the industrial chemical field, the charge is the same, but the* complaint is lack 

. of access. 

" Licensing » ' ' >- 

All states have some licensed occupations for which the health of applicants 
is deemed relevant. Where employees deal with. the. public, it is generally required- 
that they be free of communicable diseases. Thus, in- many states, barbers, nurses, 
hospital workers, food handlers and others have to be tested for such things as 
TB and VD. In some states, dental hygieijj^sts are tested for these diseases when 
they initially apply for a license. . ^ 

- Psychological criteria also play a role in licensing deci/ions. "Taxi drivers 

in New York 'City are checked through state fingerprint files to see if they have ' 
ever been .a pgitient in a state or county mental institution.^'^ Such a eheck is 
possible because identifying inf ormajion on all patients admitted to government 
psychiatric facilities is routinely forwarded to state* law enforcement files. 
Identification record3 frbajnental hospitalization files in'Michigan are siinilfarly ^ ^ 
avai-lable. In a recent cas^,'a court decided that an ex-mental patient could not 
• be refused a hack license by the New York City Police Department solely-on the " 
ground of his prior "mentajf illness . Even so, the ex-patient got his license * • 
i only by agreeing to submit to a psychiatric examination every six months. 

J I The role that medical information can pla^ in driver licensing is illustrated ' 
y the recent controversy surrounding ^the adoption of new'iriotor. vehiclfe regulations 
^ in Maxryland.^'^ The original draft of the regulations required those applying for 
or n&newing;^ driver 's license to list past treatment for the following conditions 1 
' cerebral palsy, diabetes, epilepsy, multiple sclerosis, muscular, dystrophy , heart 
cond^ition, stroke, di^aljling arthritis or rheumatism, drug ^r narcotic addiction, 
mental or emotional condition, 'mental retardation, multiple sclerosis, and. 
alcoholism. In 'addition, the Motor Vehicle Admiinistration implemented the 
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information gathering by supplying Maryland doctors with reporting forms to be sent 
to the Motor Vehicle Medical Advisoiry Boarc^ when they encountered patients with 
disorders characterized by lapses of consciousness^ The Medical Advisoxy Board also 
retjeived complaints filed by judges, law enforcement officers and citizens, , the 
most frequent reports coming from family nfembers concerned that poor eyesight of 
elderly people, and alcoholism made their relatives^ unsafe drifters. 

As a result of protests from psychiatrists and other members of the medical 
profession, arthritis, rheumatism, mental 09 emotional con^dition, and mental . 
retardation were removed from the list of reportable conditions in the regulations 
finally ^adopted. For those regaining c9nditions, the license applicant must, secure 
a physician's certificate describing the diagnosis and.. prognosis of the disease, 
along with the medication prescribed. If the license is refused or revoked on the 
basis of the certificate, the a'Jii^licant is entitled to a hearing before the Medical 
Advisory Board to Introduce medical evidence to support the granting of the license. 
In response to an inquiry from the Maryland ACLu, .William T, B?icker, Deputy 
Administrator of the Maryland Department of Transportation stated that "while all 
records of the Motor Vehicle Administration are public records ... the sole exception 
are Medical Advisory Boax^ records . " t 

^ N / 

Most state motor vehicle departmefHfs report license suspensions^ and revocations 
to the National Driver" Regis t rati oil Service of the Dejariment of Transportation,^ 
Th'ese reports include instances in which licenses are revoked Because of. mental and 
physicial disabilities. . — ^ ' 

< ^ THE JUDICIAL PROCESS • 

»Ve have already discussed jthe ^doctrine of privilege, describing ^its relative 

standing in the^commort law^ and the statutory exceptions that permit physicians to 

t^^^ify bh many matters from the*^ patient 's record. All s-tate privilege statutes 

contain exceptions that cover criminal proceedings so that medical testimony and 

32 

medical information can^^be introduced."^ In most such cases, a non-medical issue 
is at stake J to .connect an individual with a crime, for instance, the prosecutic^n 
may introduce "t;)ie defendant's previous ^story of narcotics addiction. -Defense 
lawyers may^^ter an insanitjj^ plda, necessitating psychiatric testimony or the 
introduction of psychiatric records. Either defense or prosecution may attempt to 
impeach a witness by ^introducing eviden5e about his^ or her psych olog^fc^al condj^tion. 

^ In ci%il suits, the medical condition of the individual is' often. «the principal 
focus of the proceedings.^^' When someone makes his own physical condition an issue 
in ^ law suit^Ce^^' by bringing a personal injury or malpractice action) most ' ' 
courts will pet'ftit examination of the plaintiff's physician. Medical r^ecords <nay 
also te subpoenaed in s^ch suits. 



In civil commitment proceedings, of which there are thousands every year, some 
kind of examination report from a court-apointed psychiatrist may supplement a 
comiJlaint from police or family' members. In*their examinations, court psychiatrist 
sometijoes draw on 'hospital reports. Sometimes complaints ate made that such 
commitafent proceedings are ^11 too often purely pro forma j it is alleged that some 
psychiatrists do not in fact conduct independent examinations of \J;he patient, but 
merely "rubber stamp"' the complaint from the police or the family or cJther Icy^jn^n, 
This creates a court record that the individual committed is a dan^^er to himself or 
herself or to others which becomes a part of the medical record. Thus the 
indivo^dual is permanently marked by a decision which appears tt) be a medical one, 
but which may in* fact not be. 

«■ - * 

St • * 

Medical record information is also introduced into quasir judicial proceedings 

such as disability gearings, 'probation hearings, and workmen's compensation 

review's. The medical files assembled for permanent disability cases are often- 

particularly extensive, with reports] from- personal physicians supplemented by 

th'os-e from government -appointed physicians and military records. 

What are the substantive issues raised by the increasingly widespread u3e of 
medical record information in the courts? 

— — (3.) The. doctor-patient relationship. \ Physicians, and- 'e Specially psycho- 
therapists, argue that th^ therapeutic process depends upon trust*and that this 
trust is undermined by fears that therapists may testify about patients in court^ 
When the new rules of .evidence were proposed for federal c'ourAs, psychiatrists 
were able to convince its flramers in Congress that even if communications between 
medical doctors Wid their patients were not to be privileged, it would still be 
necessary to privilege psychiatric communications.^^ ' ' 

(b) Irrelevant and extraneous medical records, Psychiatrists and medical 
doctors are resentful about producing confidential medical records in court for 
what seem to them frivolous reasons, ^ For example, in some c^vorce proceedings, a 
pro forma complaint of "mental cruelty" is lodged.^'' Attorneys sometimes use this 
as an excuse to subpoena medical or psyclyiatric records which are irrelevant' to 
the real issues of a divorce proceeding. Jt must be noted, howevei^,- that mental 
cruelty is not ahmys a legal fiction invoked to satisfy a particular state's 
divorce laws. Mental cruelty can in fact be inflicte^a by que family member on * , . 
another 5ind may play a .crucial' rple in custody cases. 

Patients and medical professionals also complain about the lack of specificity 
in subpoenas for medical recjords, and -the fact that entire medical records are^ *' 
photfcopied for the coui't, ratheir than those portions that are relevant, \jPhe 
responsibility for suc^h irrelevant materials reaching court, some bommentators say, 
lies as much with physicians and hospitals as with lawyer^^ They note ^hat health" 
professionals respond too readily to subpoenas. Instead of requiring each to be 
justifiea'\^p pourt and challenging thoge^hicA are not specif ic .enough, they are 



^ikely. to ^urn the whole r*ecord over without proteet vfhen confronted by a subpoena. 

(cj TnformeU. Consent. As previously noted^ in our discussion of privilege, 
a California psychiatrist. Dr. Joseph, Lifschutz i was sentenced for contBmpt of 
court after his refusal tojtestify about a previoizB patient. Lifschutz argued 
that genuine informed consent to the release of information from therapy records 
was not possible and that the therapist should be allowed to refuse, testimony when 
he or she felt it' in the best interests of the patient. -A more rece^nt challenge 
to that ruling, now in the appeals courts, involves a psychiatrist who refused to i 

• 'answer some of^^T^ft-qAiestions put to him about ^lis patient, His appeals brief 
argues that informed' consent is not possible be'ca^use^ the patient "...has 
knowLijdg^' of what Dr. Caesar's answers to questions a^out her might b§. Many \ J ^ 

♦^patients in psychotherapy .may^ tell their therapis^b things they perceive 

unconsciQusly which aire^in fact not true,..of' they may have no recollection or a 

very erroneous recollection of what they^ have toid their therapist," * ' * 

* # «. 

(d) Physicians* Privacy. As noted earlier, confidentiality of patient 
Records is selc^om at stake in malpractice suits,, since the^pattient is eager to waive 
it. What is at stake for the fnedical community is the physician's claim t^x^rivaey. 
Of special concern ^o them is that tissue-committee reports and other intemai 
review committees which 'evaluate physicians' performance with respect to whether 
ttre-appropriate diagnosis was made, etc., will be used against them in court 
proceedings. Opponents vf courtroom availability of such documents al'gue that.it 
would undermine the voluntairy cobpetation of physicians with essential evaluatiqn' 
committees, ahd that the evaluations themselves are s,ubjeat to misinterpretation, j 
Proponents claim that the patient has 'the right ta know if ^4.^ physic islXi has been 
criticized by his_ peer s for incompetence or negligence. * 

PUBLIC HEALTH REPORTING 

We hav|f already mentlLoned how public health reporting requirements ^affect * :\ 
medical record-keeping, ana discussed the subject in the context of its being an . * 
exception 4;o the confidentiality doctrine. Nothing more needs V> be added about 
this subject here except tlo e'mphasize that the areas where public reporting is it""* ^ V 7 

required by law have been^growing steadily during the past decades and are likely * ''V^.' 
to continue to increase. ^ 

■ ■ ■ M ' 

^' • . ■" TtlE MEDIA 1 

We have also discuss^ed the use of medical record informfition by the media in 
the context of» the "public right to know" exception to confidentiality. The ^ 
American Hospital Association has pt^lished guidelines for the release of patient 
information to tne mec/ia whiLh, suggest the following procedures 1^^ 



o A prohibition on the inspection of hospital records by media representatives. 
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0 A prohibition on interviews .or photographs of the patient without the ^sjgned 
consent of the patient and his immediate family. Even when .patienf oi^ family consent 
is given, the hospital should overrule them if it feels* the patient's caidition may 
be jeopardized,^ 

/ • 

o No release-^ information -to the media by Emergency Rooiri personnel, 

* 0 

o Infor>jnation released in hospital bulletins should be limited to name, address 
occupation, sex, age, and marital status? 'and a one-word description of the patient^s 
condition as "good,- "fair,'* ••serious," or ''critical". The nature of the injury 
may be give^ but not the details (e',g, head injury, but not whether the skull is XJ 
fractured; poisoning, but no statement as to the circumstances or ^nd or about 
^motives,) The guidelines would prohibit any mention of a patient's having been 
intoxicated, or whether there was a suicide or attempted suicide, 

o Hospitals should refer media requests for information in accidents and 
criminal cases to the police, <fr'*in the case of death,' to the coroner's office, but 
only after notification of the immediate family," . - 

The AHX's guidelines on prominent patients state: 



ore 



A person whose activity is a matter of public intei'est, or whose 
livelihood or success depends on his being kept in the public eye, 
forfeits, to an undefinable 'degree ,, .rights of privacy generally 
ascribed to a less projninent person*" 

I — » * 

^ While the guide lines(^ugg^st that patient permission is still .necessary bef 

the hospital can release information abdut prominent people, they go on to say that 

-the hospital has the added obligalfion of pointing out to the patient -that hi«^^ 

hospitalization is likely to become known and.,. public acknowledgment will usually 

•be in his best interests. [to assure] that accurate information [about] his • 

-condition will come from an authorized source," 

Reporters usually are cot given access to hospital records and they usually ^do 
not depend solely on hospital bulletins for their medical inf ormat iori The variety 
of other sources , from which reporters get their ikfprmation is a coi^entary on the 
^ looseness with which confidentiality is all too ^dften guarded. Reporters Say they 
get medical record information from police officers, from tipsters on hospital itaffs, 
from military records, and from the Veterans Administration,^-? In one case, the^ 
Veterans Administration opened the medical record of a hold-up suspect to the press, 
with the result that his treatment for psychiatric troubles find venereal disease 
was publicized in the.' New York Time s. ' , \ * 

Another factor is -that there is a double standard abcnfit information released 
td-the media. Criminal suspects, state mental patients, p^-isoners, and welfare 
clients have an made" complaints about the release of their medical records. ACLU 
Director Aryeh.((eler writes of a recent case in which a detailed description of ^ 
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murder suspect's psychological problems was provided to the press by his prison 
psychiatrist,^^. It is not surprising that people in custody, 'where _the health 
provider's lo-Jr^ty is engaged by the institution instead of the^ patient, should, be 
disfavored when it comes to release of confidential medical information, 

• \ * UW ENFORCEMENT 

Patients^ ^medical records are a natural resource and temptation to law 
enforcement of Mcers , They provide a logical place , for ' example , to start looking 
for missing penRns j to get information from victims of a crime'j to identify drug 
abusers and through them to locate drug distributors; t9 track down illegal aliens; 
or to identify suspects thought to have psychiatric problems, 

* - § 

In some states, the law specifically provides that police may get certain kinds 
of information from medical files. The California Business and Professional Code, 
for instance, requires physicians to kee> a record of the disposition of dangerous 
drugs for three years, and to keep the records 0p6n to law enforcement officers,^^ 
In other cases, thetlaw allows access to medical files when the court decides that 
this IS necessary. In many states, the law is not clear, and this allows law. - 
enforcement off icers' to make use of medical files, at least for iden-fcif ication and 
location- of a su^p^ r wi^-^&iativeiy little resistance. In the Los Angeles 
Medical (tenter, as descjribed in the Profile section, there is a-. police officer 
stationed Vull time in the medical records room of the hospital for the sole purpose 
of checking medical records for law enforcement purposes. 

A recent study of three large Philadelphia hospitals by R,J, Nathan illustrates 
that there is somfetimes a large gap between official hospital policy and everyday 
practice when it qqmes to makirig medical records available to law enfprcement 
officers,^^ For example, the official policy at Pennsylvania Hospital, as stated ^ 
by its Medical Recbrd Llbradrian/ isj >^ » ^ ' ' 

'•Medical records are the property of the Hospital, The information 
recorded in the patient's medical records is of a highly confidential 
nature • Such information should not be disclosed to^anypne without the 
written consent of the patient. Even with the patient >s consent; , | ' 

information of a paa^sonal or privileged character should be given only . , I 
- after cairef ul consideration of its value in determininfe the issue in 
question^" ' ^ 

Included in that policy is a guideline fhat confidential information will not be 
released .to the Philadelphia Police Department,' But in practice, each hospital, 
admitted its cooperation with the District Attorney's office '*if there is an 
irivestigation going on," Jtfhat constitutes an "investigation^ is' apparently the mere 
act of^ phoning the Medical ^Records room and requesting information. The police ar^ 
yell aware of this procedure and hardly ever make the initial request; rather the*^"^ . 
D,A,'s office will make the call. 
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several years ago, following a disturbance, at the Board of Education, some of 
the participants in the demons tration--black high school studejntsr-were injured by 
th^ polije and^eitjier takren to Pennsylvania Hospital or got tjiere on thfeir.own. 
After they were treated and released, a police captain called*and asked •e names 
and nature of the treatment. The Record Administrator refused to supply »the 
information, admonishing the captain that '*he should khow better," Three days ^ater, 
a member of the District Attorney's staff called and the informatipn was readily 
provided with no' further "inconvenience,*' 

r 

^ Mr. Nathan's study further notes that although the Selective Service System is* 
•specifically excluded from acq^ss to j5atient 'records in all three hdspita^s, 
discretionary administrative decision-making "will ixr^-vitab.ly divulge cqnfidential 
material to either :j^cal or 'state .[§elective*Servic/e] systems and to federal agents 
of the U.S. AViWiCMy's ^office conducting ..[draft^va^ion] investigations - ' ' 

) : ; • ' . ^ 

Hospitals- are:'nQt the only places where iav^ enforcement off icers* are -given 
access*t^ medical records. Many hi^ sJhdols, especially Inner city schools, f have ' ' 
one or more police officers pertnanYitly'^tationed in them a»d^they are given acce's^ 
to stuc^ent files, including medical records, ^ Law enforcement of ficers also^seek 
information -from ijisrurance "comp'anies • records --^usually location informat ion:-- alt hough 
they sometimes ask and receive information about" the nature of an -indivi4ual 's 
health -problems, * , ^ 



Drug^, rehabilitation clinics are also likely targets for policy investigation, 
as the case of People vs, l^ewman, already described, illustrate/s,-^^ The FBI recently 
circulatetj a leaflet to physicians containing detailed medical information about 
members , of the Symbionese Liberation ^Army 'with the statementi "If any of the above 
individuals consults you for medical treatment, you are requested to* notify your 
local FBI office", ' * " " . ' 

^ - \' ^ ^ ^ 

In 1972, the FBI placed , advertisements in two AMA journals describing^ woman' , 
wanted for consi^iracy who had a particular skin condition for Which she might seeA. 
"taPeatment, Physicians were askec^ to contact the Bureau if they identified her M 
among their patienfts,^ Protests against the« ads ^t^ oniy challenged this specific W 
'instance of cooper|ation, but raised the questiorfoY^hat might happen to the dootor^ 
patient rejLationship^ in the medical pro^ess^ion if it were believed that 'such ^ 
co'operation was routine, ^ -w * ^ ' . - 

Our society accepts a certain amount of law enforcement access to confidential 
medical records. The public reporting requirements bear this out. What is not 
clearly defined is at what point ^d lunder what circumstances this access becomes 
an intolerable intrusion on citizensj rights. If the decision is for more ti^htiy' 
jontrolied records, then it seems cl^ar'that the^only way to secure it is 'by 
specif ilc legislation snch as the Comprehensive , Drug Abuse Prevention -Act, which was ' 
invoked in the methadone clinic case, or the statute drafted in New York to ■ 
protect psychiatric records in the Multl-State Information System (MSIS). 
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- \ . ^ - MEDICAi; RESSARCH . ^ 

Americans are generally sympathetic to serious* reseeirch and to medical reseairch 
in particular. Between 1950 and 1970, public and private expenditures for medical"" 
research increased nearly twenty-fold, from around $1,00 million to nearly two^ 
billion ^dollars a year.^^ / , " 

A great deal of medical reseai'ch requires identified records on Research 
subjects, either because t)ie medical treatment of specific individuals is* being 
follov;ed in a clini*cal«.*setting, or because samples of rQseairoh respondents are 
drawn from lists of patients or clients, or because specific individuals are being 
, followed over long periods of time.^^ 

The story of ' one medical reseairch 'pro^ec|t conducted by staff members o^ a 

Chicago hospital between 1950 and 1952* illustrates how crucial identified patient, 
57 

records can be. During those two yj^airs, 840 woii^en were given a female hormone 
called stilbestrol ^s part of a. clinical experiment to discover whether t^e hormone 
was helpful in preventing the compli^cations of pregnancy. The women were not told 
that they were pairt of an experiment and none were aware that they were its 
subj^pts. In 1971, scientists discovered "4 highly significant association between' 
treatment of the mothers witff stilbestrol and the development of vaginal cancer in 
their daughters/' ^Because identified patient records werjs kept on this -experiment, 
the hospital was able to track down the patients (although theyVould not release * 
figures about how many they could riot trace) so that their daughtei^ could have 
frequent checkups to detect any eairly cancer symptoms. 

This experiment also highlights the vatriojus civil iibei-ties issues inv^olved 
in medical reseairch » the problem of informed consent, for: example, when a group 
of terminally ill patients were injected with live cancer cellsK-without infoirmed 
consent the problem of truly vtTluntary consent, which is raised whenever prison 
inmates are ^encouraged" to "volunteer" to participate in the' testing of new drugs 
the question'* of the propriety of withholding treatment from patients for Research 
purposes, tragically illustrated ^y an experiment in which a group of njen was 
allowed to go for mafiy years without treatment for syphilis so that researchers 
^ould s.tudy the course of the disease • 

\ Some other complaints hav6 surfaced over extracting data from records for 

research purposes without securing advanc^ informed consent.! In one' case, a law 
professor received permission from a judge f^' examine court files of 189 randomly 
selected cases concerning mental^ illness commitments, including the psychia'tric 
reports that were part of the proceedings.^^ When the research was challenged in 
court, the majority held that (t) those who had submitted information to the court 
file had no way of knowing that it might be used f6r purposes beyond the commitment 
proceedings? and (2) that notice of the proposed reseairch would have to be given 
Xo all 'parties corfcerned iJf there was a re'asonable possibility that the patients, 
families, or physicians ihvolved would object to the^ researcher's a'ccess. 
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Concerns about uses of patient files outside the\hospital are also reflected 
in the guidelines of a number of professional associations such as the American 
Hospital Association, the American Medical Association and the American Psychiatri 
Association, as well as in the rules of research sponsors suc>i as the^Nation^l 
Science Foeindat ion^and the -National Institutes of Health, Generally, however, ' 
the numl^er of publicized cases of harm from the release of medical data for 
research is so small that few challenges are mounted to such disclosure, in some 
recent model legislation to protect psychotherapeutic communications, lawyers for 
the yental Health L^w Project stated that^s long as hospital administrators 
reviewed the intent and procedures of research projects, the use of identified ': 
■^patiery; records in such projects was legi;|:imate requirement that' researchers 

obtain authorization from each patient woiild unduly burden research efforts," they 
said,, ^ 

• However, ^some -psychbtherapists believe that the very collection of data from 
mentally-ill patients is an invasion of thair privacy and interferes with therapy. 
In connection with a nation-wide study ,of the demography of mental patients, Dr, 
yartin D, Capell of, the Detroit Metropolitan Center for Problems in Living, stated 
that truly voluntary consent' 5,^ impossible where patients are seekii^g free mental 
assistance, ansi t;urther, that 

.... - -H 

* ^ ""Being coerced into revealing personal aspects of ■ oneself is ^ 
dehuipan^izmg. It is the equivalent of being forced to undress in 
public. .Human beings typically have str.ong Conflicting feelings 
about their education, employment, level of earnings, housing and 
previous experience with psychiatric treatment oc hospitalization. ^^ 
oust as th^y do about J7evealing themselves ^bodily, 

» *'The assurance* that the^ata will be handled anonymously is 

^empty. -In the first place, the receptionist who heats the responses 
IS a real person. In the second place, the patient i a being asked 
to tirust some anonymous authority to look after his ^personal interests. * 
I H A ?w°^ introduction to help which is intended to encourage people 
to defend their ovm interests by being given maximal power of self- 
determination," 6^ - . 

The staff of the .Metropolitan Center for .Problems in Living, agreed with this 
position and withdrew from participation in. the research project.. 

Al1;^ough, as noted, there have been few cases of unwarranted release of medical 
research data, the possibiliUy does exist. In 1970, researchers it John Hopkins 
Medical Center Segan genetic screening of incarcerated delinquent boys, and a 
tnatchM population of non-delinquents, to see if the institutionalized boys had 
a higher XYY" chromosome make-up.^^ (Most males are born with two chromosomes in 
pair 21 |rhicfi controls the^ development of sex characteristics. Perhaps four out of 
1,000 males. are borne with an "extra" male chromosome attached to that pair (XYY). 
There is thought to be a relationship between the extra chromosome an> delinquent' 
agressive behavior.) WBen; w^rd of the research project .Decame public, the 'press ' 
carried suggestions -from various sources that the data should be turned over to 
the juvenile courts,' threatening the .confidentiality of the research project. 
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Ptirthermore » no consent had been obtained from'the peir.ents or the ancaroerated 
childre<^. Unjdcr public pressure, the researchers devised some consent procedures 
and agreed to keep the research re-sults confidential. ♦ ^' ' 

■v 

ivore recently in Boston » a Science for the People group ch^illenged some 
Harvard University reseairchers who ase screening newborn . children for XYY make-up 
and then following the boys asN^hey develop to see- if^ehavioral or othei: 'problems 
develop. . The critics focussed on the possibility that children might be 
stigmatized by a record of a genetic **condition" which is in fact meaningless, and 
that their relations with parents might be disturbed if the parents begajl to see 
them as suffering from a genetic disorder. * 
, • < • 

In both these cases, and in other genetic research as well, %he fissile of patient 
access is complicated. Parents or the research subjects may want acce'ss to the 
screening results^ even trtX)ugh researchers may not be able to explain what ,the 
findings mean* Such situations ret^uire careful counselling and researchers are^ 
not always in a position to provide it. Responding to criticism of their Work, the 
Harvard researchers said they wt)uld tell parents that some kind of genetic 
irregularity had been found, but would not specify it as XYY/ A very sensitive ^ 
follow-up project had been established, they said. The Science for the Peoule group 
replied that tellinfi: the parents about the irregularity was simply a. plot to get 
them into *the follow-up program. ^ ' 



SCHOOL HEALTH RECORDS 



The tradition of keeping comprehensive files on students goes back to the 1920^8, 

but^twb relatively modern trends influence the medical content of such records • 

The first of these is that elementary and secondary schools have become places for 

the provision of public medical caire , In many communities, children r^ceiv^ brief 

physical examinations, heairing and eye tests, and vaccinations in the school. In ^ 

some CO nmunities, the school nurse determines which children are undernourished and 

should '>e included in the free school lunch or breakfast program. The nurse then 

shares Wr findings with the local welfare department which determines whether the 

I i Aft * 

child id financially eligible. More recently /mass' screening for sickle cell 

anemia Ytas been carried ou^ in some schools. The medircal information stemming from 

some of these health care activities is put in the schabl files. 



The second trend is^he Increased frequency with which the^ medical model is 
applied to deal with the learning and behavior difficulties of children in the 
schools^ I In many schools, a concerted effort is made to identify medical conditions 
such as dyilexia because of its' impact on early learning. Similarly, thousands of 
children di*e defined as mentally re'tairded or brain-damaged each year and segregated 
into special school programs. Most recently, some school systems have begun to 
define troUlesome children as ''hyperkinetic" or as suffering from Minimal Brain 
Dysfunctiohi and to urge parents to obtain the -medical care necessary to controls 
their behav^ilor, or in some instances, to put pressuire on pairents to sign consent 
forms whichl bermit the school to. administer drugs to correct the condition* 



Over tt^e past twenty yeairs, the employment of school psychologists and 
counsellors ha a markedly increase'd. Sociologist David A* Goslin reports that more 
than half the schools he studied in 1968 report recent increases in the gathering 
of psychologidai data about their students. ^ 



^ Schools vairy as to whether medical information is placed in a special file or 
left in'the student's central record/ In some cases, teachers feomment on a pupil's- 
medical or psychological problem in the anecdotal records that are stored along 
with the central Record of grade reports and other teacher evaluations • In other 
schools, such reports are stored separate ly^and destroyed when the student graduates • ' 
Goslin reports thak of the schools he studied keep health information on 



permanent file,*^^. \The fact that elementsiry and secondary education is substantially 



under local contr^oJ^ means that storage, access and retention policies for student 
health data differ Considerably across the country's school districts • 
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Several important students' rights issue-s aire raised by^the collection and use 
of school medical records t 1) the possible inaccuracy ^of medical information placed, 
in the student's filet 2) the stigmatizing or prejudicial effect that' this * 
»£Ltion — whether accurate 'br inaccurate— ajay have on the stu^dent; and 3) the ^ 
.possibly inability** of "The school '^>t§in to prevent Malth information frW^ being 
released outside the -school, . 




A major controversy about the release of $tu(i"ent mfidi^aJLj:::0coz?dS"Wtei4e-^ke^'-'^ 
sch'ools took place in New York City in 1972,'^^ A New York City Health Gpde ^ - 
regulation, passed in I9^3i required the .city ' school system to submit the names of 
drug-addicted students to the , Health Departmenx. The school system resisted 
complying "with the regulation, .supplying instead only the number of identified 
heroin users in the school system. 

The New York State Commission on Investigation issued a report in August, 1972 
sharply criticizing the New York school system for its ' "negativism" and complaining 
that *'it continued to receive these alarming reports [about student drug addiciion] 
but did nothing about them" . 

The Chancellor of the- New Yor)c school system countered that "Counsellors and 
drug-education spec;ialists who work in the schools have expressed serious doubts to 
me that they could successfully o,b.tain the confidence of students, and counsel them 
away from drugs while also reporting them to the central register," Finally, under 
^pressure from the State Investigation Commission and the New Yor*K City Corporation 
Counsel 'g" of f ice, the school system capitulated. Chancellor Scribner issued a 
directive to all ^schools to turn in the names of student drug users to the Cent|*al 
Register, : 

As to the possible inaccuracy of medical data, it should be noted that much 
oif it is contributed by non-medical people such as teachers, counsellors or 
-administrators. A teacher may no^^ on a school record in passing that she thinks a 
student is retarded or that a student has psychological problems that lead to 
under-achievement , The problem here is that such an ad hoc evaluation may be 
transformed through time and transmission into acceptance as a professional medical > 
judgment, . This issue, has been shajrply raised during the last six or seven yeai^s by 
the dftllinition of disruptive children a« "hyper-active" and suffering from minimal 
brain dysfunction. While the label^ sounds iike a medical one, several critics point 
out that i,t is a syndrome that can only be inferred from observation^ o^ behavior. 
Thereds no simple inedical test for hypera(iti>>ity . Writing to the National Committee ' 
for Citizens in Education, a parent told of her 8^. ye sir old dia'ughter ^-yitho had been 
di^agnosed as .mildly hyperactive in kindergarten, and 'now has a record 0^" being 
-autistic*" and "brain-damaged." Severallpr^ofe^^lonals. in . this field have j5tee.n .and 
'te,|i.ted,her; and^agrifee.d that this' is a wrong .diagnosis. , ' V / . * 
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Similar ^issues, are raised In the definition pf schooar-<;hiidpen as >e«tally-^--' 
ret^rded*^«v v^Mch usually results in their -being placed in,^'pecial"of ten^ in^'rior.', / 
classes, ''^f The consequences of being mistakenly labeled "retarded" are severe T 
teachers ^alter their notions of what the phild is capable of j special classes may 
provide muc|il^sg^^^ducatioTi than the child could . in fact handle; the child's 
^r^latjiin^tpwith pe^^«^angesj and as a result of all this,' the c,hil<i<s self-image 
can be dsemaged, jpausing very*"f5f2dr psychological problems^ indeed, V -C 

\ ' i. 
/Bu*t even where the judgments ar» accurate, its signif icangei may be misunderstood 
by teachers and others who see the record, *That was the fear expressed by parents * 
about the widespread sickle-ceil testing done on l>lack children in schox)16,'^^ A 
group of New Jersey parents filed a, complaint with .the State Board of Education which 
challenged the decision of the Orahge School. Board to have school ntirses and lab 
technicians test for sicklelcell in the *<5ity *s predominantly black snhools : 
"♦•••serious economic and social ramif ic'ati ons are resulting from the improper 
sti^rmatization of the fickle-cell trait," The parents and other commentators felt 
that such testing might term already disadvantaged children because teacher^, might, 
not fully grasp the fact that this^ trait has no medical consequences for the child 
at all. r y ' . > 

Such^ fears about accuracy and' relevance of the materials iri students' .^lles were 
a chief impetus to the passage of amendments to the Elementary and Secon-daryf^^^.^ 
Education Act,, ' Known as the Family Educational Rights and Privacy Act, the 
legislation for tlje first time gives parentis' and students over 18 access to 
elfe|entary and secondary school records, The^Act has been in-effect for less than 
a^year, and it^is too early to tell how widely pVents and students will avail 
fH^fmselves of this new access and ^hat efrect it wh,l We on how school records ^are 
ke|>t. 



) 

R£HABILITATION-A-ND"SOCIAL WELFARE PROGRAMS 



Local, state and^federal government are undertaking an increasing number of 
rehabilitative §Lnd social welfare programs that involve me dical records , Two such 
programs— treatment of drug ad'dict? and child abuse registries— illustrate the • 
ongoing controversy about how many records should be kept and to whj)m they should ' 
be disclosed* " . • ' ^ 



Drug Addict Centers 



' It is not surprising that law enforcement agencies are keenly interested in 
drugaddicts, and tKe records kept on them at drug treatment centers . The cost 
of maintaining a heroin habit for one day is estimated^at between $40 to $150. This 
means .that the average addict (who' does not have independent means), must steal up to 
three times the cost of his->abit, since he^can usually sell what he steals at no 
more than a third of its value. Ix is estimated that between 30fo to 50% of all^ crime 
is dru^-related, ' " *'*r3^ 



\ 



.On the other hand, medical experts' stress\ that drug addiction is a disease , 
.and can be cured only through mentar health treatment, ^ Thfl most commpn"^ technique 
irs'to provide medical and moral support during Withdrawal, and then to administer 
a heroin substitute such as methadone in stable \dosages over protracted periods 
while providing medical care, psychiatric treatment, ahd job' and family bounseliing, 
IJa^t of* the treatment is the establishment of a c^onf idential relationship between 
therapist and.'addict. \ ' ^ 

\s the director of one methadone clinic put itT "The entire effort made; in ; 
' t^eat^nent'and rehabilitation would quickly~e fr^s-6rated if "treatment" appeared 
to )}e nothing more than ^ law enforcement ^echniq:ue\ aimed at identifying and 
harassing those who seek ^help .Without the confident and trust established by ^ ^ 
insuring conl-identiality, those who need heip most will not ask for it,*' 

Mistrust in promises 'of confidentiality was the ri^ain reason for the" failure* 
of the 'armed forces' massive effort to 'deal with military drug ,abuse. The ^ 
mistrust was well founded*. To encourage participation \in its drug treatment 
program, the Service promised that drug abusers who volUteered for it wou ld not 



be punished for possession cJr"' use T'* or given less thari honorable discharges. But ^ 
according to testimony at. Senate hearings in 1972, m^ny Servicemen who sought help 
.for thSlr drug problems received^ none. Inste;ad they we re\ processed foi- administra- 
tive discharges as drug abusers. ' 

\, Qovernment agencies supporting methadone maintenance dlinics sometimes wish ^ 
to'examine patient 'recoijds Vo^ bthe^ than law- enforcement rbasons. The-Foorf-and 
Drug Administratlon..oh^ged,Vor example , that ^ a clinic in nAw York was failing to 
determine whether its patients Were heroin-addicted^wheiV theV applied for treatment. 
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The* clinic, thfe .PDA claimed, *was thereby creating irtethadone addicts out of non-heroin 
lasers. Clinics in Calif ornia* were charged with- enaour-agiHg*.4)aM^5tt6L^ta. s / 
methadone from thfee or four different cllnrcs by refusing to submit^ the. names -.of " 
th^ir pati^ts to a central register, 4 ^" . — • 



- According* to^^ survey of 172 Methadone Maintenance Clinic?', a fhird of the , 

states have laws requiring that physician, file a report whenever he trea'ts an * 
addicted patient and nearly, all of' these lavs require tU^ patient's identity. 
Pour states specify that the reports must •be held' in crSnf i^ence j' two states require 
them to^e confidential fecept 'to health an^ law enforcement agenci»es; in two- 

, states they^are open tb^general inspection and ih.^the icest/'of the states, 

^ c*onf i'dentiality of the record^s is not <nenl;ioned • 

Mosi: of the ^t&tes with drug reporting la^g^keep centralized state-wide * 
,4rug-addict registries which, in\ddition to patient* ijdenti-ties , contain personal 
^ dat& ^ather^d /rom physicians and treatment programs, Lpcalf arfd state agencies that, 
fund drug-'^r^atment programs may collect adSii'ionalvinf orma^idn. One drug abuse S ' ' 
pr^^am director complained to tlie Pen^&ylvania Council on' Drug and Alcohol Abuse ^ 
that "This program has consistejitly protested der^ands made on it by the Allegheny 
County Mental Health and. Mental -Retardation^ Program to 'supply them. with confidential 
information concerning ^our patients ^It -wks necessary for this program to refuse to 
accept f undoing from ^( the; Cpunty) ^ order .to protect the" confidentiality of our ^ \ ' 

**cl3^ptS, . . „ * ' 

* A hea'ted controversy /about S^an FranciscV's methadone maintenance* program 
involved the l^al state" and federal agencies who fund drug treatment 

programs. The local' agency , with the,/iupport of the Mayor, made its, medjcal* - 
• records available to the stai;e agency^which funded the program on a matching basis 
with the federal goverrimej^t. But the local. agency refnoved the patients' names 
from the records, vexcej^t Tor the. patients^ referred to treatment; as an alternative 
to prison, * . . , * 

The state charged that removing the names w^s in violation of federal guidelines 
and prdered the clinics closed, :The local agency^ appealed directly ta the Federal 
Pood and'Orug Administration which^ finally agreed to acce^dt the records without the-' n 
names. But the state remained adamant that , the patients '.^names must be supplied. 
As matter's ^tand now, the .clinics are qlosed for refusalVo. comply, and state " 
legislators' are introdaacing bills to^amend the 9ta|e»s Welfare and Institutions Code . 
to end the requirement that methadone clinics' pdtien • names' must be supplied to 
the state , ^ . ' ^ . .-.^ 

A simile controversy arose in Massachusetts, in ' connection with the Federal 
government's Client-Oriehteid Data Acquisition ;Process (CODAP),^ ' In this program, 
. in return- for federal funding, local drug programs mdst provid4 the f oyowing ' 
i^iformation on participants 1 ^ birtK^date, sex, ..race.,- zip .code, f irst.. two . initials 
of mother's Igiven name^, firk two initials of motheir's surname, The Information 

• ■ ' , » ' .1 
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could 'be int^erfac^d with several ^lists , among'them the Social Security 
Administration's files or a state's vital statistics bureau to produce the name and 
address of^ any participant within 30 seconds. Both the Governor' of Massachusetts 
''gnd^the Mayor of BQ5ton refused to authorize supplying.^this information f6r drug 
patitenta in the Boston are* and declared they would forego the federal funding 
rather than comply. Again, the federal government made a special exception and 
s^id it would not cut off funding if the patient recfords were not iiientified, w 

• • \ • 

According to the sur^vey, me"^hadone 1;^atiment centers in states with central - 
drug registries complained of problems of maintaining confidentiality 50^ more 
often than centers in states without' sucfi registers. The information sought by 
centra^l pegistries included drug, criminal and medical history, social and demograpji 
data, prior drug treatment amd employment #data, Moreover, the centers complained, 
"information in government. . ,files frequently finds its way into the hands of 
police or of private credit bureaus or other businesses," 

. ■ . • . ^ r . ' 

As to the physical sectirity o^^^lhe records within the 172 centers surVeyed, 
95% of the centers keep them under lock and key and protected by a sign- out 
" procedure for authorized personnel. Only a third of the centers use the additional 
protectixJft* of assigning nqmbers to files instead of ^atiefits'' names. 

Child Abuse Registries / • * ' 

Recently cited, statistics estimate that one American child in 600 ^ies of ^Viild 
abuse. T> states have been responding to the growing incidence of child abuseGor 
some years. Between 1963 and 196?, every state in the Union and the District^f' ^» 

Columbia enacted a child-abu^e ^^orting statllte which ^required physicians and other 

'89 • ' 

healthy professionals to report, sw spec ted child abuse. ^ In the past eight years, 

thirty sta-tes have established central ^child-abuse registries to which any person - 

9(5 

may report a suspected case of child abuse. 

.On4 of *the ch^ief purposes of the? central registry is to attempt to identify , 
parents or guardians who are involved in multiple episodes of suspected child abuse. 
Abusing parejits often seek to cooceal r^peatr episodes by -bringing the child to a 
different ctinlc or, health center fer treatment ^ach time. 

The federal government also maintain? a national child abuse registiry in Denver 
at the National Center for. the Prevention of * Child Abuse which .operates under^the 
auspices of the Offic> of Child Development of HEW. The thirty states with central 
registries send tmidentified recprds ^o the National Center f O'r statist iSal studies. 

Most., of the lejfislation establishing central registries does not de^l with the 
questions of access by accused parents or guardians, *^r t]ie confidentiality of the 
material in the xegi^tl^r^. The typical st^tute^ simply ma^^ates the creation of d 
•registry to which any citizen may make a report:,, gind there Is no barrier i>o these 

♦ registries being shared with law enforcement agencies,* the*^courts, social service 
^^feencies^-^welfare ^departments, ^etc,^ , ^, ^. * * • ^ . 
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• V -.'Seven states impose .varying degrees of confidentiality oo the^records, a^nd 

thje^n^vt York statute does permit, access by parenliis or guairdians ' after allowing the 
DepsLTtment of* Social Welfare ninety days in which to make an investigation.^^. 
- After that, the pairents or •guar<dians must be informed of what has been said about 
them, but they aire not told the name of their accusers. The accused are entitled 
to a hearing with due process protections, and if the accusation against them 
iJannot be documented, they have the right to have the entry about them deleted from 
tlie refi:istry. I^his is the only state statute with an access and deletion provision. 

Accordir|g to A jan^ Sussman , Director of the Juvendle Justice Standards Project 
» of th6 American Bar Association, "child abuse" is a loosely interpreted term. A 
further concern , is that the registries serve ^ only to stigmatize" the pairents or 
guaordians, often by totally unsubstantiated gossip j the state has little capacity, 
once.it gets information on child abuse to provide care for the abuse4, child or 
counselling for the abusing parents. ♦ 

. , • - CaiCLUSIONS » * ' * ♦ 

* * * 

Secondary uses of medical data raise the sharpest clash between society •s 
interest in protecting medical cpn'f idfentiality and its interest in a wid«* variety 
of other important functions, both private and governmental. In each area we 
e'jcamined in this chapter, a rational case could be made f pr evei:y exception to 
th^ normal rules of medical privacy and confidentiality.. Sometimes we saw the 
decision to override confidentiality traditions embodied in the law, through 
legislation, administrative ruling or court decision. These, legally sanctioned 
exceptions tend to legitimate those other e;Xc^tions whiah have developed simply 
-.as a matter of oifganizdtional practice.' , ^ 

There are, however, two impor1*ant recent social forces that operate to call 
these exceptions to confidentiality into question. The'first is the movemd?it for ' 
social fchanee durinr-the past two decades whicfi has created outspoken constituencies 

* for, racial, and sex equality, cultural and sexuajL diversity, political dissent, 
consumer righ.tfe, and the ri^ts of such stigmatized groups as ex-mental patients, 
persons in psychotherapy, women se^;^ing abortions, etc. These^groups view the use 
of health 'Crilpri^ in decisions about employment, education, credit, government 
benef its;etc. as a devicd" to reinforce restrictive social judgments about non-, 
copforming social 1)^havior. The debates such critics initiate ■WeT'-^^rivracy" are 
often reaaiy challenge to the way that conventional socie-ty confers its rewararr 
•and f avorsv amqpg the population. 

> .] . - . ^ . ' 

The seccfnd social 'phAiomenon is the deepening distrust of government that 
marks our era,' not ^only among the forces for social change, but dn the general 
popj^ilaUon. This oynicism and distrust of the government's willingness and ability 
to protect confidentiality may sometimes overshadow the public's approval of many 
of the'secondary usjes 'of medical data treated in this chapter. In an era of 
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confidence in ,the government's go"od word and fdir play, thesfe secondary uses would 
*rarely' stir significant public concerns* Given the harsh realities of the late 

1970 's .however, any .discussion of secondary uses of personal medical data must begin 
'with a recognition of *this public distrust, and a realization that it underlies the 

p:rowing discussion of whether ex'isting laws'and controls over" medical data u§es are 

sufficiently protective of citizen rights. 
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CHAPTER TRENDS IN COJ^PUTERTZATTON OF MEDICAL DATA ' ' 

ft 

INTRODUCTION ' - . . 

Part One documented how widely medical (and pseudo-medical) information^ is now 
distributed throughout the organizational settings of American society^ and no^ed ' 
the main civil liberties issues involving medical data that had already come to the ^ ^ 
fore by the time computerization 'spread to the health care field. Having laid down 
these pre-computer baselines^ we turn now to the- automation of personal medical 
data. ^ , - ' ♦ , 

'Computerization in health care is expanding in response to the same general* 
stimuli that have made automation attractive in other sectors of American society. 
These include: risih^ demands for private and government 'services by customers and 
consumers; demands for faster data transmission; the heavily increased paperwork ' 
necessary to satisfy such transactional demands; the rising costs of clerical labor; 
*and increased government reporting and auditing requirements to satisfy social 
accountability. 

^ These pressures,^ plus some special ones, sire present in health care. A 
dramatic example of the escalating demand for services in the health field" is the 
increase in annual hqspital admissions: from 10 million in 19^0 to 21 million in 
1955 then 35 million in 197^. This rise in patient demand for services comep 
both from the well-to-do and from the indigent who are now cov«^^ by veirious new 
eroverilmental payment programs. In addition, there is a br.oadened\cope to medical 
treatment, born of advances in drug therapy, operative procedures, and medical 
technology; greatly increased paperwork required from doctors and ^health institutions 
for repayment purposes; increased reporting requirements for fiscal i^i ting, 
quality-care assurance and public health purposes; the high cost of ph^ician and 
paramedical time in meeting such record-keeping**^«Qd^^ porting requij?ements ; and 
most recently, the growing impact of various * legal' duties , ranging from 
documentation of procedures to avoid malpractice liability to recent judicial 
dec^is ions' requiring mental health institutions to prove they are furnishing adequate 
care to their patients. All of these functiona — plus others — create, ^an enormous, 
ever-increasing data-han'dling operationri Studies within hospitals estimate that ^ 
from ?^=to ^^0^ of hospital acti,vity is devoted to collecting, recording, 
communicating, and reporting medical information.^ . * ' ' . ' 

^ In H^acing how computers have been used in ii^lth care, it is helpful to recall/ 
some overall trends in organizational computer -Hcage during the past, fifteen to 
twenty years. ^ The basic pattern has been for ^^utomation to movef^-first into an 
organization's financial activities (payroll, accounts receivable, etc.) where 
personnel had previoi* experience y/ith electric accounting machinery and where the 
data being processed was of a highly r^iitine, fixed character. Coipputdr system 
developers moved next to automal^ large-volume, frequently used files containing 
data on clients^ customers an^ subjects that Was easily abbreviated and "objective" 
in nature. The gcfal here was to replace expensive clerical labor who were performing 
repetitive task's, , with the additional hope that service^ could, be improved at the 
same time. - ♦ ' 
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Many organizations moved in the 1970*s beyond computerization of routinized 
operations and into^^au|dmation of more neirrative, specialized files > attracted by 
the prospect that mdre sophisticateTi computerization would improve the quality of 
decisions by line officials or^by managers (a prospect strongly encouraged by 
vigorous ro fayket^g fro m the computer industry)' ♦ Recent years have also se^n efforts 
by some organ i^sa^^ on s to develop* more integraljion of their various personal data 
files, through multi-f^le databanks and management information system^. Here t he- 
objective is to proviVie a comprehensive information system for management, and 
even to reorient major aspects of the organization's structure and procedures airound 
the "total" information systeiitv, v * 

On* the whole, this general progression in computer utilizatiorr* has been the 
pattern in the l^ealth ^care field, 'In describing that pattern, we have'focused ^ 
the first two zones of our three zone model— primary health ceire and the activities 
of service payers and quality care assur^ce. This will be followed by six detailed 
''case histories" of Zone 1 and Zon^^ 2 organizations that are actively engaged in 
computerizing personal data file». Automation in Zone 3 ' is so extensiv^and so 
variegated that it would take a separate study to describe computerization in law 
enf oifcement, government welfare and social service prog^ms, employment, education, 
etc. Although it is not necessairy ^ describe the entire range of computerization 
trends in Zone 3 , we will treat the development of government health agency 
activities in planning and program*^ overs ight> since this rests so heavily on calls 
for health data to,, be furnished by Zone 1 and 2 organizations. The way in* which 
automation of other Zone 3 organizations creates demands for health data from 
individuals or health providers will be treated in detail in Part Four, the section 
devoted to analyzing how computerization is affecting citizen .rights ir^^health \ 
data, . • — - 

ZONE ONE: PiJIMAHY HEALTH CARE PROVIDERS 

There are almost as many schemes for classifying primary health care "providers 
as there are professional organizations doing the c,lassifying. For our purposes, 
it is useful to organize a survey of computer applibations here under three inain 
headings: " , * 

A, fioctors* offices, small clinics and sm'all J^ealth centers, generally 
with ambulatory or out-patient practices. 
, B. Hospitals and larger clinics and health centers, both in-patient 
^ and out-patient services, 

^ -^C^Other primary health services, such as corporate health departments, 

prisons, nursing homes, etc. . ^'^^ 

A. Doctors' Ofj^'ices and Small Clinics/Centers- ^" 

An estimated 80^ of health care over 900 milliori 'patient visits^tin 1973-- is 
delivered in the practitioner's office.^ While there has been no national survey 
of ED? use ty individual or group practitioner^, Daniel^, Hsirris of the American 
Medical Association's Department of Computer Systems inlMedicine estimates that 
between 10^ a»id"15^ gf, these practitioners are now usingl s^ome^ f prm of EDP.^. This 
assumes use by Atoout''2^^^^'''^5$^of sole* practitioners and pei^rhaps 20^-25^ of physicians^ 
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,*^in lar^er'yroup practices, 
^ 'Vost of, this computer use in offices is done by contracting with organizations 
of ferin?^ service bureau operations to doctors. These include bureaus sp on soared^ by 

' local or state medical societies, commercial firms specializing in medical data 
professing, f^ei^eral data-processing service bureaus, and bank and insurance company 
computer services. Generally, these are batch-processed operations, with input 
fo;rms sent*from the doctor's office by messenger or mails to the bureau for 
processing. Only a few firms offer doctors on-li-ne medical billing and administrative 
reporting services, where the input is made to the service bureau's central computer 
directly from a terminal in the physician's office.^ A very small minority of 
doctp^r's offices have their own computers and. a complete data processing system on 
the premises . 

By far the most common computer application for doctor's offices is billing and 
accountinp-, with office-administration and claims-reporting features increasingly 
"hun£^ ontoj* these systems. A study by the American Medical Association found only a. 
minority of office aonputer-users pursuing more clinically orient^xi applications; 
the rrost common of thesd are computerized patient histories, automated multi-phasic 
health testins:, computer-assisted diagnosis, me4ical records, scheduling, ECG 
anajysis, and laboratory analysis*^ In addition, some doctors — probably ^ the 
hundreds — have developed computer applications geared to t}^ir practice specialties 
or individual Fese^ch Interests, mostly by obtaining computer time and file 
stora^^e from a university hospital system or a service bureau.*^ ^ ^ 

One leading-^dee effort to stimulate computer use in the doctor^s office was 
a federally-funded (HEW) project conducted between I971 and 197^ by the consulting 
firm of Bolt, Beranek, and Newsman,' at a cost o'f $1.1 million. Called CAPO 
(Computer Aids in the Physician's Office), this venture placed terminals in a group 
of 13 physicians' offices, linked by telephone line to a cervtjral computer operated 
by Meditech, Inc , Bolt, beraneK and Newsman provided software programs, orientation, 
ajTd" instruct ional training to the' phy&i^ians and their staffs. . 

The computer applications furnished by CAPO included automated medical history, 
both for general screening and various ^pecialtie^j diagnostic consultation j 
paramedical /support ; patient education and family health planning; and administrative 
services (billing, patient scheduling, etc.). When the project ended, four of the 
13 participating offices indicated they, would continue the computer services at 
their own expense. . Inside and outside evaluations of the project agreed that some 
practitioners liked the system (where it responded to problems they felt to be 
important) but others did not find the system particularly helpful. The Costs of ^ 
hardware and softv/ar^' as of 197%were such that only physicians seeking innovation 
m their office routines would be likely to adopl^. j^i|ch a service, but expected 
reductions in cos/ would jDrobably make such systems iJiore a^:tractive a few years. 

Citizen Rights V^Aspectg of £DP in Doctors' Offices 

fie notety three trends in doctors' office computer use that affect citizen » * 
rights. -First, the main purpose — and effect-t-of adopting an automated health 
screening, /patient history, and patient profile system is comprehensiveness,. 
Doctors we/talked to said that the range of subjects covered, including physical and 
emotional /state, family history*, scrcJ^l situation, and any economic, political or 
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other stress-producing factors rela/ing to medical problems was far greater than 
they typically obtained with patients previously. In addition, where* a doctor in 
the " jot-it-dovm-pn-a-5-by-8-card" tra would have r^co^rded only tjtie most pertinent . 
information, often in a half-legijbl-e notation useful for the doctoi*'s own needs, 
automated patient records now prc?dube detailed* personal historfes that can be read 
by all the personnel in the offi^ce, , ' 

Second, the presence of such detailed records creates a major evidentiary 
r^esource for insurance companies, ^workman's compensation .investigators , aijd others 
involved^ in civil litigation involving claims. These record? offer a patient- 
elicited declaration of conditions at the time the history was taken, plus" the', 
results of various lab tests, exajnin^-tions and further interviewing that are^part 
of the record in a multi-phasic, c^tinuous history. Thus, automated patient 
screenings and histx)ries are increasing the scope gf data collection iia doctors' 
offices, the centralization of data frOm different reporting sources, and the 
potential set of claimants who ask to see such records. 

Finally, where outside EDP* services sure being used, an important factor is the 
spread of personal medical, information to service bureau employees, The'very fact 
that a well-known person has visited a particular practitioner (especially one who 
is a psychiatrist, or a cancer specialist) can be highly sensitive, and thus t^ie 
disclosure that Citizen A is being billed by JJoctor B could be a significant 
violation of medical confidentiality. Beyond this is the fact that- some medical 
billing services do put substantive information »n their statements, if this is the 
, way the doctor gives it to them or if the standardized "billing package" calls for it. 
Service .bureaus are well awsire that confidentiality and security of the data 
entrusted to them is vital to their business success, and various kinds of personnel 
and security protections are used in these operations. However, some of the most 
celebrated bre^.hes of jsecurity for confidential^ business data have taken place in 
servi'ce bureaus during the :gast decade, and the movemeiyt^f personal^ medical data to 
this location clearly represents anew risk to confidentiality. * - 



Future ^^ospects for. EDP in Doctors' Offices ^ 



Spokesmen from medicine and the computer ind^^^ry expect the use of computers in 
doctor's offices and small clinics to move slowly^^^ut steadily upward in the next 
five years. They cite the increased exposure to computer.s that physicians receive 
as they treat their patients in hospitals; courses in' medical sc>iools about 
administrative and clinical uses of computers i the current trend toward greater 
group rather than solo practice, creating more practice units for which coJnputers.^ 
could be cost-effective; and the funding of various ]^o jects(such as CAPO)' by \ ' 
.federal health agencies to develop tested applications and encourage greater EDP use 
in doctors' offices. Possibly the most important factor is the rapid price decline 
that isjtaking place in computing services » as Small-system computers and ' 
minicomputers move into monthly costs for business data processing that many 
physicians are finding attractive.^ 

B> Hospitals, Clinics and Health Centers 

The moat recent national survey of computers in hospitals was conducted in late 
19714- hy the American Hospital Association.^^ Questions on computer tise were sent to 
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.the 'Association's 7»108 member hospitals . Of the 5.912 hospitals (83.2^)'*that 
responded, .3,364 (5^*9%) reported they were purchasingi^-cmt-of -hospital Computer 
services, while 1,441 ( 24. 4^^). reported having their own in-house computer, (In 1970, 
"a survey by the Hospital Financial Msmagement Association r-eported that ^2% used 
outside EDP services £ind 19,2^ had in-house computers. 

The size of the hospital is the chief , factor affecting in-house compvker use. 
Only 3,4^ of the hospitals having 6-2*^ beds have their own computer, compared with 
55*3% of hospitals with 400-499 beds and 43.2^ of hospitals with o^ver 500 bWs, Size 
does not determine the purchase of . out-of -hospital EDPi 40,2^ of hospitals ^with 
^6-24 beds ,buy computer services, compared with 48,2% of hospitals with 500 beds and 

, . ^ , • .■\ ■ 

Of the hospitals that buy outside EDP services, the AHA survey found the^most 
com^non applications to be business and firfancial (37,1^) and professional audiV; 
(17^yS). Electrocardiogram analyses {11%) was the next most frequent, with dietary, 
radio\therapy planning, "other cTi^ic^l," and "other non-clinical" among the 
remainiVn^ activity. 

Tbe\ survey ask^d hospitals with one or more in-house computers about the kinds 
of applications being used in each of ten majop depairtmentgl^nursing, laboratory, 
pharmacy, Mdioltjgy, admitting, dietary, medical record's, personnel management, 
out-pat ientyfemergency amd intensive caire/cardiac caire. The responses showed .that 
the single most frequent computer use was for budgeting and statistical reporting, 
and that such.Vse was spread quite evenly through these departments (ranging from 
13,6% to 17*5^^i3 All other applications combined in each department ranged from a 
low of 3,5% to a\high of 9%, 

In terms of e^juipment, 684 hospitals (11.6^) have lairge computers (defined, as 
costing more than $\oo,000), 1>017 (17,2%) have mini-computers (defined as costing 
from $10,000* to $100,000) and 402 hospitals (6.8^) have remote terminals, 260 
hospitals (4.4fS) report they have both mini, and lairger computers. Use of^ terminals 
"increased with the 'size of t}\e hospital, from 2 hospitals having 6-24 beds, to 
148 hospitals with over 500 beds. The use of terminals in hospitals has incre.as^.d_- 
dramatically since this survey was conducted in'l97J^. One estimate is that between 
one and two thousamd hospitals now have remote terminals. 

These survey results reflect the general pal^ern of computer use found by the^ ' 
National Academy of Sciences* s£udy to mark the. rapidly changing- world of computer, 
communications and microform technologies during the past three decades. In each 
field of business, government, and associational activity, there are a few 
organizations whose managerial style, resources, competitive position, - and technical 
competence lead them to become leadilig-edge users. They are the first to try new 
hardware^ anci peripheral systems as they come jput, to attempt ambitious software 
applications, and to risk organizational change aha ^eople^ plrpblemst* in these ' 
efforts. Some leading-edge users are highly successful (measured in terms of 
fulfilled expectations, realistic costs, etc.),. others — possibly a majority of the 
pioneers— are satisfied with enhanced prestige as willing experimenters, rather 
tham being able to show truly cost-effective oper'sftions. (Computer* experts ♦have 
coined the phrase, "The early. Christians get the hungriest l?ons...") 
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A second type of computerizing organization is the mainstream user, 'These .tend 
to be more cautious, willing to w^it until n^w' equipment/and applications are ^tested 
and proved by others, or else to make relative;.y guarded initial adoptions ("We do 
things in a modular, step-by-step way here i the ^big bang*' Isfi^t our style,") In 
any field, thi« is where the great majority d£ computer users are to be foutid. 

Finally, most fields have their Ibw-users . those who do some cfompuierized data' 
processing ^but ,a,re well below the mainstream aveirage in their area, Sometimes' this 
is a matter of size, resources, or the particular function within the field that the 
particular organization performs. ^ But it may also be a general management resistance 
to computers on ideological grounds j fears of reaction by* clients, custonjers , or 
subjects toward automation of particular information functions; or resistance by 
influential groups of professional, middle-management or line employees toward the 
introduction of computers beyond a limited payroll-personnel/chock^writing, level. 

The hospital field fits this pattern closely. During th6.past decade, a. small, 
number of American hospitals, perhaps 25-30, ^ have ^ttempte,d :to develop applications 
.leading toward the goal of unified or "total"' computerized hospital information 
systems. (When asked by* the AHA survey whether they have a "computerized hospital 
information system," 275 hospitals (^.7^) say they (To, and 395 hospitals (6.75^) 
say they "plan"^ to- have one./ No one using the term "hospital infosmation system" in 
its usual meaning of integrated files, cpmmon data base, and comprehensive software/ 
can take such declarations seriously^ As^ Collen and ot^ejc authorities have stated, 
ther^ are no such, systems in Operation today, nor is thei,r appearance imminent . )^^,. 

Possibly-a hundred other hospitals have pursued new applications 'in particular 
^reas beyond the mainstream financial and administrative uses, as With Various 
clinical and ancillary services, multi-phasic screening,' $n-line patient histories,* 
in-house laesearch, medical education, medical audit, and tHe like.^ As successes have 
be'en achieved ii;i some of these areas, the -systems have been shared or marketed, ^d^~ 
have entered mainstream status. * ' . 

'^L^ow users are probably a largej:. percentage of the hpspital communitSr than.ir\ 
^maxiy other fields. THe majority of hospitals today, are medium and small sized 
institutions '^d are still limited either to financial an^i reporting applications 
supplied by service bureaus or small computers with software packages supplied by 
computer manufacturers. 

Special Features of Hospital Computerization 

Some aspects of hospital automation bear directly on citizens^ rights and 
deserve special attention, 

1 ♦ Patient-Record Application ^ ^ 
* y ^^^^ )*j 

Only a minority of hospitals with in-house Computers or which use outside EDP 

services have automated their stored patient medical records. Some. of these .users * 

))ave patient-history and multiphasic screening pi;:^ograms, and some have d^loped 

automated records based on the problem-oriented medical record developed by Dr. 

Lawrenjje Weed, J Most of these are for^ ambulatory , rather than in-paUent use,s. 

2, Hospital Information Systefhs - • - r 

As noted above, there Ve currently no full-dress hospital information systems; 

'(HIS), although a small group of American hospitals is working toward developing them. 



.Amon^ them are t Kaiser-Permanente and El Camino Hospitals in California? "Massachusetts 
General in Boston? the Harvard Community Health Pl^rand the Texas Institute for * ^ 
Research and Rehabilitation, in Houston. *In. psychiatric institutions, HIS-oriented 
hogDitals include the Institute for the Living in Hartford, Connecticut? Walter Reed 
Army '"edical Center in Washington, D.C. -and other institutions using the Computer- 
3upport-in-!Vilitary-Psychiatry project? the' Fort Logan Cental Health Center in Denver 
Colorado? the Connecticut Mental Health Center in Uev/ Haven, and other institutions * 
• usin^ the N'ulti-Staire Tnformation System for Psychiatric Patients, developed at the 
Research Center of Rt)ckland State Hospital in i\ew York? and fibspitals participating 
in r»ri&souri's Standard System of Psychiatry project ♦^'^ ( 

/hat distinguishes these HIS projects is their commitment to creating a, Single 
and unique patient identification number and concentrating in one central record the 
data from all .the patient's past and present hospital 4nd out-patient^ service 
contacts," -Including"! if present) psychiatric data. The goals of such unified 
record-ke?epin^ are both medical and administrative: to makd possible the most 
complete and informed .diagnosis of health problems and evaluation of treatment, and 
to generate the data base from which to* improve in-house administration, claims 
i^eportin^, professional review, and basic medical reseairch. The very richness of , 
the patient records in an HI3 system underscores the citizens* rights issue — how 
secjurely viiXX the data be kept from those within the institution who have no need to 
see it <e.^: limiting^ psychiatric data in general hospitals) and from those outside 
payers., quality-care reviewers, and secondary-data users who may demand access to 
HIS patient- files, 

3 • ^ eovernment Hospitals ^ ' - * 

In its 197^ survey, the AHA included 36I federal 'h'bspitals,, 1»^38 state and 
local ^overhmen^ hospitals, and' 4ill3 private -hospitals • Comparing" trends in 

— - — "l^fi " * • 

computer use shoved: ' ^ ' „ ^ ^ * * 

w Uses Computer ^ ^ - Has In-^House 

Type of Institution * Services Computer 

Federal hospitals > 53*5%^ \ 16.6% 

§tate and local government": hospitals ^ ^1,2% . ^^.2l3,.9^ 

^Non-Government, not for profit ' ^ 63^,0fo . ^ 3Jl.,l% * 

,N on -Government,' for-profit t . 60,5^ » 1?,6^ 

TJ^ese figures show that computer use by government hospitals falls between 
tjie higher-use not-for-profit pirate institutions and the lovfef^uFe"^^r-profit 
instirtutions. However, trends in government hospital computerization require special 
attejhtion because of the sheer size of government health programs/ At th*^ federal 
level, for example, the Veterans' A^dministration hospitals are the largest medical, 
organization in the United States, with I7I hospitals^ 200 clinics, 5V500 full time"" 
physicians and 21,000 nurses. In 1975» they serviced 1.1 million veterans, with 
15 millioo out-patient visits and almost 30 million prescriptions.^^ To the VA 
system, one must add the hospitals maintained by the U.S. military for service people 
and tjieir dependents, the U.S. Indian^Health Service, hospitals^f or the Merchant • 
Marine, and special federal h^'alth institutions, ^long with the. hospitals maintained 
by municipal, count^-^sind •tj.tgite 'governments-, this puts a very lar^ part of the 
nation's hospital beds and hosp^ital admissions under government auspices. 
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The analytic literature on computerization in government hospitals shows ^thaf 
automation patterns do not fit into anyne'^t "government" versus "non-government" 
categories' the leading-edge,^mainstreaJn, and low-user pa4;;terns in hospital 
computerization are distributed about as ^evenly in government hospitals as elsewherl} 
However, enactment of privacy l^gislation affecting government agency files, such 
as the Federal Privacy Act of 1974 and similar Acts in four states as of* early 1976, 
means that government hospitals will^ be the first affected by such new "legal rules, 

^* IV^iscellaneous Health Programs 

Automation has also moved ir)to a juumber of Mother .health care activities. 
Automated f^ultiphasic Health Testing Centers are now found throughout the country, 
independent of . hospitals , with well-known f>rms" suQh as the Life Extension Institute 
and the American Health Foundation offering this as an off-the-street commercial 
service. The patient record that is generated is given to the patient or his/her 
physician, ±iu$ a copy is kept by the screening center, much as income tax preparation 
firms kee]i copies of the returns they^repare for cli^nfs,^^ 

Another recent development is the wallet-sized medical history car4 or- "medal" 
that^^^kfidividuals can carry 'gr wear wherever they travel. Some of these feature 

line-readable patient data strips while, others have microfiche forms that can be 
put into r^eaders in a health care institution. Such personal medical information 
includes allergies, drug sensitivities, cardiac " readings conditions such as 
epilepsy, and other matters that would affect treatment 'if an individual is seized 
with a health emergency away from home. Several million individuals now use these ^' 
portable medical-record devices. ^.^ * r 

Still another computerized area is that of local blood banks, both the N 
community -run non-j)rofit agencies and the commercial blood banks, Here, the 
acqu3,sition of. patifent medical histories, the testing and coding of blood 
'characteristics, .managing inventories, and the creation of files matching patient 
identities carefully with donor histogy and blood code h^ve prompted^considerable 
USB of automated systems. The American Red Cross has initiated a ^iatiopal, 
computerized Donor Deferral System, with patient identities included,, desired to 
minimize the dangers of transmitting hepatitis by blood and blood product uses,^^ * - 

CITIZEN. RIGHTS ISSUES IN HOSPITAL EPF 
1, General. Changes in the' Patient Record 

As in doctor's office's, computer use in hospitals is changing' the nature of 
thet paiieht 's file. In- many hospitals in the pre-computer. era, record-keeping 
was hit-or-miss, and though ^ots of paper accumulated in th'eT'ecord, these documents 
were often in disarray, without any indexing or current summary. Now, while the 
character of^personal information that is being collected for automated patient 
records is not different from what was recorded before, the automated personal 
data are being more svstematioally collected , more fully recorded and more 
centralized in permanent files. Patients processed through automated history-taking 
are systematically asked to disclose the full range of physical, social, family, 
emotional ;and other personal data, and the resulting^detailed patient .prof iles 
become a regular feature. of the fdle, updated steadily as the patient remains with 
that care provider, ^ , j ' ^ 
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From health care standpoint, this is, one of the most desirable f^eatures 
of automat i-on^-patient records are full, uprto-date, easily understood and are linked 
together from various departments and previous epifodes. From a civil liberties 
standpoint, however, this trend me^ans that all the medical and- pa/amedical personnel 
in a facility who have access to the computerized files now have more detailed 
personal data and more comprehensive social histories than in the typical manual 
system, epccept for psychiatric facilities, * * . * 

In addition, computerization patient data is^ f acilitatijig (ancj is sometimes 
directly intended to facilitate) the sending of some autonjated . patient data to 
orpanizations outside the primary care sector — to service payers and those charged 
with quality care assurance, and to the Zone 3 users such as public' health agencies, 
welfare and rehabilitation programs, licensing authorities^ judicial authorities, 
employment-insurance evaluators and so forth, ^''uch ^f the computer-based' information 
^activity in these zanes depends^ on automation of data bases in the hospital for 
timely and complete input. The ^f uirther automated the hospital data are, the easier, 
cheaper and more rapidly Zone 2 and 3 organizations cam call for production of what 
they want. Autgmated centralized patient records not only mean greater ease of 
transmission at a lower cost, but also the availa^bility of far more detail in the 
medical record. than has been the; case in jthe past. This means that these records'^ 
will require not just the. observance -of traditional standairds of care as to 
confidentiality (uneven as those have been) but a new definition of legal and public- 
policy boundary lines for data-sharing, and the creation of monitoring and 
enforcement machinery t-o police^ the boundaries. 

2. Privacy Issues/ 

v/e have observed that when individuals seek medical help, they willifigly reveal 
th^ most intimate, aspects of themselves to the ^lealth professional; collection of 
such data is-cleariy relevant to treatment. Revealing financial or family data may ' 
be less acc^ptajble, but even here, the justif ica*tipns for requiring disclosure are 
strong. . ♦ 

However, ks we noted in Fart One, there are issues as to what should be recorded 
and for how Iqng it should be preserved, as in the case of the San Francisco women 

who sought to/ have hospitals return the "psychiatric^n^d" letters written by their 

* I *^ 

doctors to justify abortions befo^re^ttj^ 15^7-2,- Siipreme^ Ooup-t- ruling. We^did-.nat learn 
'^from the ACLu attorney handling t|^is .case whether there were any coded njotations in 
computerized! files about^he letters i -or -whether they wer^ only Jeep t in the manual 
files. 3u"W the problem of what is to be^recorded in computerized records is likely 
^-tS be ah ii/(creasin^g problem, as illustrated by a letter from a pediatrician who 
practices /in a large metropolitan hSQpital:^ ^ 

The compu^terized records, she wrote, were "incalculably valuable for both 
information retrieval, scheduling of appointments, etc. But it poses terrible ^ 
problems in our treatment of adolescents. What do I do when a youngster tells me 
she is sexually active? I need to retain this information to assure the problem is 
dealt yith in some manner. What about drug use (illicit)? What about negative 
altitudes towards parents or school? A missed menstrual period and possibilities for 
pre^nAncy? I need to record these 'matters'^ but am deeply distressed about their 
availability to anyone on the computer (and we have had some bad experiences in this' 
lin^). 

' 100 
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"T have been consictering a bipartite record j the first is available to anyone 
needing' health information and is not compromisory data in amy way; the second is 
"confidential"" data and either not stored in-the computer at all (but kept in a ^ 
separate confidential drawer) or if stored only available to one or two. key people. 
But this is difficult to work out," 

^ We see this as a 2one 1 issue becalise if l!he stigmatizing information were not, 
ift'eserved in the files of the primary health provideir» the problems of ancillary 
• and se^condary uses would be eliminated or greatly lessened. If primary health 
providers insist on preserving everything for legal, research, or administrative 
purposes, we.cem expect considerable conflict dver the increasingly rich and detailed 
files accumulating in hospitals, health-care pleuis, employer medical records, and 
school and university medical files, especially in the automated "total patient 
information- systems" - > ■ ' 

Also a privap^^atter is the issue of whether a given automated system has 
informed patients that their medical data is being aujtomated, and how it will be 
used, 

3* Confidentiality Issuefe 

iihen they reveal intimate personal data to health professionals, patients 
expect these to be kept "confidential," following the ethUJal .and legal norms 
commonly understood to attach to the doctor-patient relationship. We have ^already 
^ discussed how widely identified patient data ar^ now disclosed for Zone 2 activities ' ^ 
and for many secondary governmental and private uses noted in Zone 3, including > 
releases of information to the press, to law enforcement, and to commercial- 
repdTrtinf^ agencies that raised serious cc^f identiality issues, generally because* 
there were no clear legal controls over such' data-sharing, ♦ 

Because detailed medical records are still kept in manual files in> primary " 
health care, this is where improper or disputed Leakages of personal health data 
are still centered. The same management policies, doctor's ethics or hospital 
cooperation with outsiders that made these disclosures possible coiXl^ take place 
from automated medical files in, the future as these come to be repositories of 
more detailed p^tient^f iles , 'Thus, the citizens^* flights issue is to see how 
securely'*^ he irtbre detailed and "richer" automated records can be secured against ' 
such misuse - m ' <■ 

Patient Access to Records and Nledical^Inf ormation v 
^ Traditionally, as we have already discussed, th^ medical profession has 
maintained ,that the doctor should decide wha"t the patient should know about his/her^ 
condition, treatment, or prospects. Records in health care facilities have been 

' considered by law to be the property of the institution , and patients normally have ^ 
b^en able to inspect their records only by bringing a lawsuit for negligence and 
getting k court order authorizing access. In recent years, consumer and patients' 

^rights eroups have .championed the right of patients to s'ee their records if they 
wish and to have them explained by the doctors where the notations are" not ^ 
intelligible to laypersons. These same access disputes ^irise when personal medical 
data are placed in automated filo^st where no' duplicate manual files remain, the 

^rfght of a patiei?t to get a printout of his or her record will be the basic issue. 
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Fut'^ure Prospects for HosDital Computerization ^ <r * 

Hospitals hfve not used computer,s as extensively as many* other industries, such 
as banking: or insurance ♦ A survey in 1970 reported that Ater a decade of 
automation in hospitals, "55^ of all hospital . informatiQn processing appldcation? are 
Still performed by hand,"^"^ and this f igvr-e -<h^' not been substantially reduced today, 

'The relatively low use of computers is /^fiected i^^he sales figyres. One study 
reported that sales of hospital computers in 197^ were only$156 million, even ^ 

^tlteOlRh American hospitals spend between 7 and 10 billion annually (between 24-33% 
of their annual oudgets) to acquire and communicate information,^^ 

Studies of hospital automation aire in agreement about the causes for low EDP ' * 

30 ' ' ' 

use here. The major factors have been: resistance by medical practitioners ^and 

allied health prof essionals j the high costs and disillusioning failures of early, 

wide\y-heralded hospital EDP pfo.jectsj uncertainties of funding for venturesome 

efforts, and an absence of strong federal commitment .in this area^j and a lack of 

clear ''systems concepts" around which to o>rganize the f^les and flows of information, 

The^ last problem is seen as stemming as much from conflicts within the medidal 

profession and among medical planners as to the ways to oreshape health-care delivery 

as it has been the failure of systems experts to develop good systems models of the 

medical milieu as it really opera,tes. * 

However, recenf marketing sttidies have been highly optimistic about the future 
of EDP use^by >iospitals. One study predicts hospital computer sales' will go to 
$380 million by 1979 • ' ivore specifically, the marketing forecasts pre^dictt much 
wider us'e^ of remote terminals to capture medical data where it is generated?^ a 
s^rge in the use of small in-house computers among'smaller hospitals (75-300 be'ds); 
wide use of computerized hospital management systems supplied by various 
manufacturers and s.fervicas on a "turnkey" basis (installed and ready to use)j and a 
growth in multi-hospital associations or data-management plans that wi'll make use pf 
shared (fata procfessing facilities, 

vany academic and medical-professional analysts reach similar conclusions about 
the bright future o-f computer use in primary ^ care , Dr, Marion J. Ball, director of 
the computer Systems and management group at. Temple University's Health Sciences 
Center divides hospital computer systems today into two levels, Level I is 
focused on data collection and message-switching capabilities ( admirustrative data 
processing) and does not "maintain an electronic patient medical file," Such 
systems now cost approximately $1 tb $2 per patient-day. Level' II systems "maintain 
a complete computerized patient medical record during the patient's hospital stay, 
and are programmed to handle clinical information as well as requisitions," Such 
systems now range from $2,50 to $9 per patient-day, depending pn how many clinical 
applications are in the systems Using Dr. .Ball's classification, Dr, Stanley E.* 
Jacobs, former director of the^diyision of computer .systems of '"the American Hospital 
Association, predicts the following: "By 198O I anticipate that at ^least^ 50^ of all *- 
short term general hospitals over 200 beds will have installed at least a Level I 
hospital irfformation system. By 1985* I expect a majority of these hospitals will 
have Level II,., "^P 
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X^ot all the experts agree' that hospitals are approaching a major take-off point 
in computer usage — at least not in the near future. At the conference held to 
discuss a preliminary drsift of. this report, several experienced observers of 
computerization in* primary *care emphasized that hospUal compute»r uses so far 
represent a stitching together of bits and pieces of separate applications, ^hat 
has been lacking is the development of a conceptual mo4el df information p;riorities 
and uses in the hospital, especially a model that could be generally accepted by ~ 
doctors and otherthealth professionals and bjr the patients, not just by health-c^re 
hospital ^busifiess managers, and data processing^<^chnicians . 
Until sucTi a professionally-acceptable and patient-regarding model is developed^ 
thr\oue:h a ^asic rethinking , of organizational goals, professional rewards and roles, 

, and man-inachine relationships, many experts feel that computer u§e in hospitals will 
remain oriented to adminisfVative data processing. and limited elinibal programs, 
rather than moving toward larger information systems of integrated files and'*' 
patient-record data base^. Those taking this view believe that- even the infusion 

• of large amounts of money for developing hospital' information systems— something 
that has not been present in the 1965-1975 decade— would not lead to significant 
breakthroughs in the near future. Even passage of national health insurance would 
not make a major difference, in this view, since such a system would- almost 
certainly operate through' limited data reporting systems, and would not compel 
hospitals to develop comprehensive information systems. 

One' of the reasons 'for the divergency of predictions about more sophisticated 
use of computers in hospitals in the future is^the lack of agreement about their 
value and cost-effectiveness in the present. Most observers agree that computers 
have helped hospitals and health centers me^t the crush of. paperwork^ in patient 
billing, accounting, claims processing and administrative reporting. They also ' 
a^ree that computer applications in perhaps a dozen areas of clinical use have 
improved the delivery of services and have been cost-effective. Beyond th^se areas 
of agreement, however, the effects of more ambitious information systems are 
difficult to measni^ witti anything approaching scientific rigor, or even marketpl^ace 
criteria. /Vhi'le some interesting efforts have been made to evaluate the effects 
and cos^B of particular hospital information system projects, a receni? conference 
on %he evaluation of health information systems concluded th^t there was little'^ 
agreement today on the terms and procedures fpi: such evaluations, and that it m*ay be 
too early 'in trie evolution of such projects for evaluation to be more than 
experimental and tentative .-^-^ 

Because^our study deals with the impact of computer use on citizen rights, s&id 
is not a study of the effectiveness of hospital computerization on health care, we 
did not attempt to make a national estimate of how hospital information system 
projects are dfting. We did look to see how the activities of a sample of such 
leading-edge systems are affecting individual rights, and this appears in our 
profiles in Part Three. ' , 
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C. Other 'Primary Health Services 

As we noted in Part One direct health care is provided in a considerable number 
of institutional settings foday' other than doctors' offices, hospitals, and public 
health centers. Automation has spread deeply into some of these other locations, 
which include college student health services, corporate medical programs, nursing 
homes, prisons, school nurse and emergency offices, and similar facilities. We will 
look^at one of these college health services, to show how automation is heing used in 
such facilitiies. " ^ » 

There are about 2,500 colleges an\ , universities in the United States, v/ith some 
7 million students ii) attendance. The institutions usually provide health services 
for resident students • ^ngifig from in*patient emergency care to regular medical, 
dental, and mental health services with full time staffs of doctors, nurses-, and 
other nodical personnel. Typically, colleges obtain a medical history from the 
entering student, maintain a regular patient medical record duriqg the course' of the 
student's matriculation, and keep special files for drug and alcohol abuse data, 
birth control and abortion data, suicide episodes, psychiatric care, and similar 
matters. 

Some colleges and universities have developed their own Computerized patient 

record and administrative systems, and are much like medium-sized "community health 

centers in their patterns of 'computer utilization. A few leading-edge systems, such 
' * ' 36 

as the Harvard Community Health Plan, serving students, faculty, and. staff members 
•of the Harvard community, have pi6neered,in advanced applications.* Particularly 
interesting from our standpoint are the commercial firms that market automated 
medical questionnaires and problem-oriented records for these purposes. For example, 
Medical Datamation, an Ohio-based company, offers DASH, Database Acqulsi*tion for . 
Student Health. This is a 964-item self -administered questionnaire that covers 
personal identification, family, and^ insurance items,' then asks about demographics, 
allergies, immunizations, hospitalizations , 'illnesses , disability, other medical 
problems, ^operations , fractfures, medications, habits and risk factors, eating, 

exercise, smoking, alcohol, drugs, tra^a, and information or help wanted by'rhe 

Student. The questionnaire also asks for data on each of the main bodily systems and 
presents 44 questions about the student^s feelings. , *' * 

DASH offers a medical database report, a problem list, a pr^oblem-monitoring 
report, and statistical sximmaries, all generated from thfe automated data. The basic 
report package costs about $10 per student. The company claims that the DASH process 
saves colleges considerable time over traditional history taking, eliminates the need 
for "most pre-enroj-lment physical examinations" for the average student, and allows 
better concentration from the outset on Students with problems. 

The questions asked about "Habits and Risk Factors" and "Feelings" illustrate 
the scope of inquiry:- ' ,' 




i' »,4*A8ITS and RISK FACTORS' 

k • ' , 

f Your habits influence your ability to achieve ami 
i rnaiQtaif} good health arid lorig lif^ Most of the 
* guestions on this page reflect factors which increase 

your risk of developing physical or emotional pi^fblems 
^ Please answer each question realistically ^You are not 

being 'graded", and this is not a test 



ALCOHOL 
Yes No 

540 _ Do you drink alcohol?' 

541 Old you formerly dnnk alcohol bpt stopped' 

// you have ever drunk alcohol, specify 
amount and duration 

542 *■ Occasionally, socially 55J6 _ Less than 1 year 

543 Several drinks/week 547 1 to 5 years 
544' _ Several drinks/(^ay - 548 - 5 to 10 years 
545 _More than 3 'drinks/day 549 Over 10 years 



I 

f 
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EATING Do you generally or frequently - 
Yes / No 

500 _ Eat irregularly., skip meals' * 

501 Eat an excess of^ animal fats, dairy foods'* 

502 — Eat an excess of scgar. ptestrjes, starches'" 

503 — — ^ Ormk 5 or more cups of coffee per day' 

504 — Drink 5 or more cola driSks per day' 

505 _ — Tend to stay overweight' 

506 — — Tend to stay underweight' 

507 - -- ^-^ £^*frurts reg[u(^ly, every day' 

508 - - Eat vegetables regularly, every day^ 

An excess is a LOT, like 5 or more single servings 
per day of the type of food in question 



515 
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EXERCISE Do you generally or frequep^Jy - 
Yes No 

Get heavy exercise on an 
irregular basis' 

Consider golf, bowling, archery and 
similar sports strenuous exercise' 
Get some type of regular exercise' 
Get regular strenuous exerctse such as 
running, swimming, bicycling' 
Oo you know the fype of exercise 
required to strengthen the heart' 
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SM0K1NO 

V 

Yes No 

525- K , Do you smoke a pipe' 
526 Oo you smoke cigars' 

527. , — Oo you currently smoke cigarettes? 
52S - Old you formerly smoke cigarettes but 

stopped completely' v 

// you have ever smoked cigarettes, 
specify amount and duration. 



529 
530 
531 

532' 



Less than Vi pack/day 
-Vi to 1 paCk/day 

1 ^to 2 packs/day 
-Over 2 packs/day 



533 ' Less than 1 year 

534 1 to 5 years 

535 ,_,5. to 10 years * 

536 -Over 10 years 




You're well over half dohe now. 
The hardest 'part is over ' Press ont 



555. 
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ORUGS Do you generally or frequently • 
# 

Yes No « 

. Currently use pat,^eed, downers, 
acid, heroin or any similar drug' * 
. Formerly used such drugs but stopped' 
— Know the common names and appearance ■ 
of various forms of such "street" drugs' 
- KnoV/ the short and long term effects 
of these drugs' 
If you have ever used any of the drugs mentioned above, 
specify which ones and how often 
Yes No 



559 — 


— »- Marijuana (pot) 


560 


Rarely 


561 


Frequently 




— Amphetamines (speed, uppers) 


56^ 


Rarely 




Frequently 


565 — 


— Hallucinogens (LSOTacid, mescaline) 


566 


Rarely 


567 


Frequently 


568 -1- 


— Narcotics (herom, H, morphine) 


569 


^ Rarely 


570 


TrequenUv 


571 — 


— Methaqualone <Sophers, ,Quaalude) 


572 


— ^ Rarely 


573^ 


Frequently, 



TRAUMA, ACCIDENTS and OTHER HAZARDS 
Do you frequently — 
Yes No 

Rtde a bicycle on heavily traveled roads' 

Ride a motorbike or motorcycle?^ 

— Ride a motorcycle without helmet and jacket' 
— _ Tend to exceed the speed Itniit while driving' 

Orive after drinking -alcohol or takjng drugs' 

Water ski cy boat without a life preserver' 

Walk alone at night m a strange neighborhood? 

Hitchhike or pick-up hitchhikers? 

Get exposed to very loud noises' 

Get exposed to insecticides or dangerous 

chemicals' j 

Know how to swim' 

Wear reflective clothing when walking 
after dark? 

..S,Know how to give CPR (cardio pulmonary 
resuscitation, artificial respiration)? 
K*now how tOj give mouth-to mouth breathing? 
Know how to give closed chest cardiac massage? 



580 
581 
582 
583 
584 
585 
586 
587 
588 
589 

590 
591 

592 

593 
594 
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FEELINGS Mark the frequency with which * 
you^ha^e the feelings or problems listed 

M = Most of time 

S « SomB of time 

N « None or rarely 

|M S N 

850 — Feel sad, depressed^ - ^ 

851 Feel lonely? 

852 ^ Cry without apparent reason? * 

853 Wisn 'to end »t all? 

854 Plan a way to kill self? 

855 — Unable to concentrate on anything? 

856, Awaken, can't go< back to sleep? 

857 Sttll tired after, a night's sleep? 

858 Feel tense and anxious? 

859 More nervous than your friends? 

860 Worry about health? 

861 Worry about things generally? 

862" Have trduWe failing asleep? 

«863 J3mp at sudden noises, shake badly? 

864 Have frightening, recurring thoughts? 

865 Feel calm and contented? 

^66 ^ . Unusually ajraid of high places? 

867 -J Unusually afraid of closed places? 

868 " Unusually afraid of crowds? 

869 — » Suffer from nervous exhausticJn? 

870 — Get upset easily, highly irritable? 

871 More touchy than your friends? 

872 Go to pieces if you don't constantly 

exert control over yourself? 

873 Get angry when told what to do? 

874 Feel more violent than your friends? 

875 Get along with'-people? 

876 Get upset ^hen things are not precise 

and orderly? 

Do most things on impulse? 

Feel It is'OK to steal as long as * 

no one gets hurt or caught? 

Feel overly shy, sensitive? * 

Get feelings hurt easily? 

Greatly upset by criticism? 

Tremble or feel weak whenever 

someone shouts at you? 

Feel optimistic about the future? 

Get completely mixed up when you 

have to do things quickly? 

Afraid to be alone? 

Usually Wish you had someone 

to advise yQu? 

Have feelings of ir>adec|uacy? 

L Have stfong feelings of dependency? 

Seem to be ipore aggressive , 

than your friends' 

*- Have legal problems? 

Have financial t)roblems? 

Have marital problems? 

Have family problems' 

Have sexual problems? 
Have questions about sexual matters? 
Feel someone i? out to '^'get" you? 
Hear. voices when no one is around? 
Feel som'eone is coritrolling you 
ip an unusual way? 
Feel vou are responsible for the sins 
of the world? 



877 , 
878 

879 . 

880 , 
''B81 

882 , 

883 . 
884 

885 . 

886 . 

887 . 

888 . 

889 . 




TESTS During the past-year, have you had 



Yes No 



920 
921 
922 
923 
924 




8lood count? 
8lood su^r check? 
Che.st x-ray? 
T8 skin test? 
Unne check (urinalysis)? 



) vo 
heli 



INFORMATION 

on the following, or fielp with problems you may 
encounter in the areas described^ 
Yes No 



930 






Alcoholism 
> 


• 1 




931 






Birth confrol 


'J 




932 






Cigarette smoking 




933 






Diet programs , 


t 




934 






Drug abuse * ^ 






935 






Emotional problems 






936 






Exercise programs 






937 






General health hazards ^ 






&38 






How to cope with loneliness 






939 






Legal problems 






940 






Marital problems 


1 


• 


941 






Money or financial problerhs 






942 






Self-breast exam 


1 




943 






Sexual problems 






944 






Ver>ereal dfsease * 


1 




945 






What to do if a medical emergency occurs 







COfSlCLUSION^ 
Yes f^lo 

960 C^o you have any other problems not 
° covered by this questionnaire? 

Please^^give us your opinion of this system 

961 _>^^Qreat 

962 Good 

963 Generally good, criticism minor 

964 Don't like it • 

Please sign your name. * 

Sighature , . 



You're cfone! ^ 

Thank you for completing the questionnaire. 

Pleale check back through to make sure you haven't 

skipped any section? or pages. 

*, 

Enclose the^ completed questionnaire along with 
your check to "Medical Datamation in the postpaid 
envelope and mail as soon as possible. 
Good iuck at college! 
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From these questions, DASp produces a 
following samplfe/on a fictitious "Suzanne 



Medical Database Report illustrate'd by the 
M. Taylor./' 



OASH.^MEOJCAL DATABASE REPORT 
TAV^i^R, SUZANNe ^. 

SSl ^25»US*6759 
NT! U" 
^Jt 122 lbs. 

Ho'»'t Addr*»8s{ 
25^1 HIULCRF3T AvE 
ti0^t>\ ANO, MI 50521 
PhonA 2l0-9«7»65a3 

Health Insurance! 
Pl*n College Insurance 



MOUNTAIN STATE U^^IVERSITY 

Otte Comolttedl 1»16»76 
QuettUnn«1re Nymbert 65a32l 
Enter: 9-76 
Class: Not ioecHled 

Emergency No 1 1 f 1 ca 1 1 on t 
TAYLOR, THOMAS J, 
FATHER 

5596 CASTALIA ST 
POCKY RIVERV>-IL 32109 
PlTonei^ Reiponte uncert,e<n 

f9m\]y Physician: 
SCHMIDT, EDWARD A 
309,9 w CENTRAL BLVD 
WOODLAND, MI 5a32J 



DEMOrRAPhIC: r^orn USA, USA cItUen, Ctucaslin, single, children (OOh, 
tuPo^^rtea t>y family, qrew ud In rurel area, middle income level/ 
PrPtfstant, objecf to blood trtnsfuslon. 



PA^T HISTORY 



AL^EOGIES: Penlcl 1 1 <n. 



iMMUNIZATICVi)! DPT »61, 
No German measles. 



DOl l/o oral *6U, smal 
meesl es, mumost 



Idojt »62, tetenus toxoid »71, 



HOSPfTALIZATloNS: Illness (01), operation (01), 



iLlNfSSES: Alie.rg1esi hay feveV/ 

elco^ol U*^', ar^emle, cancer, depression, diabetes/ ew'Physeme, 
h^art d1 setae ^ hypertension. Insanity, kidney 
peptic ulcer, thyroid disease. 



)^'No 

epilepsy, heart dttac*t, ..^^ 
disease, nervous breatcoowr. 



F^ItY ILL.N'ESSES: Alcoholism, allergies/ anemia, dePressiorir diabetes, hay 
f#ver, heart attack, hypertension, migraine, multiple tcjerosls not 
^ecMlftd, nervous breakdown, rh'^umatold arthritis, stroke*^, 

NO bUeoino trait, cancer, epilepsy, heart disease, 1n#anity, s"ulc<de 
at^e«^^pt, thyroirt d1 sea'se, tuberculosis. 



Chi cken^ OOt, 



knee Injury, me^aslet, mumps,' ovarl an 



OTWEO PfeS: Cystitis, . 
cyst, hfhooPlnq cough. 

No arthritis^ chronic bronchitis, soastlc coH 1 1 s, chol ecy st It 1 s , 
German measl es* .gonorrher, hepatitis, Infectious mono* pye 1 ontph r 1 t 1 s, 
phieKltIs, POlio, rheumatic fever, rheumatic heart, syph|.Mi, 
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OPPP*TIONSJ TontiJ Uctomy, y 

FRACTURES: ^or^e. ^ 

ME'^KATlO^Sf AntthUtsminer .bH^t^^5^|fv^rol med, vittminsj oth^r medlclnrSft) 
Or^AoiLITYt R«r^«r*ent Dhysld^^;! di*tbW^^ty, ob that Precludes taking Pt, 

HA^ItS'AND R1S»<S P^ACT0R5 , 

OI^TiRYx Eats \ rj^^gu] 9r]y f excess &ataj»tea fatsr excess coffee. 
No excessive carhoh'ycJrat-esr cct^JP^inks, 1 

E)(^RriSE; Irregular heavvf exercise^ n& regular strenuous exercise^ lacks 
•ex^rf^se < n * OPT** t 1 on , * 

SMCKTNG: Sn^oites cigarettes^ less than 1/2 oack oer day» less than 1 yeari 
Does not s'^oke a D<pe» ciga/St 

ALP0»JOtt Orinki alcoholr sociaHyr duration not specified or uncertain, 

OR''G?t Cannot identify street arugsr lacks drug effect i nf ormat i'on, 
' Does not currently use drugs, 

* 

TRAU^A/HAZAP£)Sl Oef iciest "ir* CPR^ 'def i c i ent in resusc i tat i on» deficient in 
Cardiac T^assaoe, 

Ooes^not -Jrive after alcohol or drug use# oarticieat^ i rK h i tchhi k i ng» 
get* ^xDoseC to loua nolse^sr get evDosed to dangerous chemicals, 

• "c., -.^ - I 



S,Y^TPMS kFvIEw j 

HEAOt No oroble*". ^ ^ >|t " . 

Nio dyseoul Hbriu^f vertigo^ syncope/ seifures^ weunesa 'arm(s)^« 
weakresf leg(s)f oaresthfsias armCs)/ oarejsthesi as legf^)» headaches, 

EYFSt No problem, f 

No visual ob not corrected^ esotroDia^ exotrooia^ col orj^l i ndnassf 
bHndntss#'' eve oain* diolooia/ halos around lightt, 

EN^t Frequent rhinorrhaa^ freouent sneezing. 

No bearing loss^ earaches^ sinus trouble^ DOstntsel drio^ epistaxisr 
ho^rsenessi carious teeth^ bleeding or sore guns^ uooer platen lower 
Pl»t^, 

'hE4Rt and LUNGS: No problem. 

No heart valve problem^ murmur^ irregular rh^thm^ tachyca'rdi a# - 
cardi ofT^egal y » wheezing# persistent coughj chest Pain, dyspnea. 
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No nAUtea# vomlt1na# hemat emtt 1 • # m« 1 6na# cff»prh6ai eons t 1 D«t 1 on# rtd 
blf^c^ In stooltf indigettlop^ abdominal p«in, 

< 

URTM#RYl ^0 orobleift,^ 

No enu^esis^ 1 ncont 1 nence# nocturU* freoutr>cy# dyturl** Ktmaturia* 
fUnv patn with ^ever^ hesitancy," ' ^> > 

■» * * ♦ 

wo*'E^t No PAP te$fr within Datt year. 

No t recast nodgl0f v^ag1n1t1t# dys pareunia* frigidity* Irregular 
ment^ti ^renorr^»ag1 a* current pregnancy, 

MU^C"LOSK£tETALt Joint stiffnett due to 'injury. 

No neck pain* back pa1n# twelHng of feet or lower 1agt# joint pain 
not < n j u r y re 1 at ed, 

OTWEP SYSTEMSt Dry tkln'or brittle nails, Intermittent fatigue, ; 

No polyalpsla, weight loss, constant fatigue, between meal weakness^ 
rarlHly growtnQ mole, rash or pimrles*, hot flashes, fever or chills, 
PaM^r, swollen or tender nodes,* 



FfP^lTNCSj Sadness or depression • S, loneliness - 5, tenseness - S, mora r,^' 
tens* then friends - H, worries generally - S, feels c^lm and contented • " 
H\ compulsive - M, highly sensitive and shy • S, more aggressive than ^-Vj?" 

friends - S, * ^ j:*^ 

No suicidal desires, trouble falling asleep, frightening recurring / f ; 

tKouoht^, frr^teblllty, vlolt«t feelings. Impulsiveness, sensitivity to 

t , > ''A 

criticism, orost^ 1nadeauacy# arots dependency, stvuaf problems, feelings 
of persecution, audio .^al 1 uclnat 1ons# delusions. , ^ > J, 

TEJ^T^.PAST YEARj No chest X-ray, TB skin M»st, - ' ^i^'* 

iNroPMATifoNi Exercise programs, health hazards, self-breast exam, medical ' >^T- 
emep«encies, S . " \ f'^J 

AO'^ITIONAL PbSl Section not ma?ked, 

0P7NT0N OF SYSTEM! Section not marked. 
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^ The issues raised by the use of such automated history programs as DASH were ' 
hrghl^ighted communication our project received from a nurSe who is serving on ^ 

the privacy comm-ittee of a state medical records association'. She commented j^^, 

"It is my opinion that the program DASH is a problem in the area of autpmajtion 
of student medical information. First of all, the ques^tionnaires are compiled into 
a problem list - it seems that DASH places in this problem' list any 'Yes' checked by 
the student in the questionnaire, including sCich things as information requests if or 
birth control or emotional problems. What qualifTes^-these as •Pr6felem areas'? , 

"In addition, the Problem Monitoring Report stronglj^^ violates privacy%and 
confidentiality, in the questionaire , the student is not told that such reports will 
be compiled, nor is the student told whp will have access to the reports (faculty, ' 
counselors, etc.). The IVonitoring Report could be particularly harmful in a s.tudeat 
health service where often times non-professionals are employed., and who might 
disseminate the information to unauthorized persons. The sensitivity of the data"^ 
compiled in the DASfi program indicates to me the potentially harmful effacts of 
sjuch a proe:ram." - 

A special problem of citizen rights posed by the growing. automation of data 
in the direct-care facilities of colleges, "corporations, penal ^institutions and the 
like is that the doctors! and other medical personnel in these settings are employed ^ 
by organizations that exercise authority over the individuals receiving the medical 
care— as educator, employer, correctional agency, etc* As the volume ai?d sensitivity 
of the personal and medical data in,these cyiputerized fil^s^ increases --jt^jstrated 
by the DASH profile-.the issues of who else within the college, company, or 
correctional institution obtains access to these data become?^ critical , as well ^s 
issues of how ancillary uses— for .research, service^ payment by third parties, quality 
^care assurance— and secondary uses^-licensing, law enforcement, drug reporting, etc . — 
will be administered. 

ZONE TWOi SERVICE PAYERS AND HEALTH-CARE REVIEWERS 
Service Pavers . * *\ ' 

•^e have already described the hatiire and operations of the American health 
insurance system. As we noted, 190 million Americans are covered by private health 
insurance, 1%^ in groujy plans. About 51^ of this .business 'is written by commeAjial 
health insurance f-lrms; ^% by non-profit f irms j and the balance of h\% by the "Blues" 
(the 71 Blue Shield Plans reimbursing fpr doctors and office, procedures and 73 Blue 
Cross plans covering hospitalization). 

^ Before the passage of Medicare {1965)'^and the initiation of Medicaid (I966), 
automation of private health insurance files 'had |)roceeded actively .primarHy using 
the "batch-prAcessing" of first and second generation computer systems. With large 
policy-holder files to record, premium payments to administer, claims to process, 
and management reports to* generate, many health insurance companies were heavy users 
of computers in the first decade of organizational automation. ] 

During the pre-Medicare era, the m^in government involvement as a ^ervice payer 
came from st^te and'^ local welfare departments, which bdre the main burden of 
reimbursing doctors, nurses, and hospitals f'or services provided to the indigent 
outside of the public jpedical facilities. .^1^. .-^311^ 

' ' ' 
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After federal grants-in-aid to the states for such payments were initiated in 
the 1950 's, state payments to medicat vendors under public assistance welfare 
programs rose to $51^ millipn by 1960.-^^ This put the additional burden; of 
information management f^ such payments primarily on local ^nd' state welfare 
agencies. Beyond the minimum financial applications, computerization waS slow in 
unfolding? in government welfare departments in the 1955-1965 e1:a,\for reasons that 
include the deeply-bred "hand-work and case-work" traditions of such agencies, "a 
"Great Society " rather than management-efficiency foc\is in the I96I-65 phase, and 
the primacy of political factors in local management of, welfare eligibility and 
distribution. ' ^ 

The passage of ^^edicare and Medicaid radically changed the automation patterns 
in service 'paying. As George A. Ryan, has written, "the rapid influx of ^':edicare ™ 
(claims reached almost unmanageable proportions. NiOtwithstsmding the comput^r 
facilities available to carriers, the data management problems which occurred as a 
result of f.'edicare legislation defied^ for a time efforts on the parts of many 
carrfa^s to^cope with the volume of claims data, "^^ From I966-67 untijf recently, 
most of the commercial, Blues, and non-profits were preoccupied">iii%-^doptiag third 
snd fourth generation computer system approaches to meet these sharp rises in ^aims 
^ processing.. For example, Blue Shield claims went from 200 million in I968 to an 
estimated 1.2 billion in 1975' Today, claims processing consumes about 50:^ of EDP 

expense in health insurance operations Our ^profile of Mutual of Omaha in Part 

- .Three shows how one leading-edge user responded to these dynamic conditions in the 
past decade. ' ^ , 

State welfare agencies were given primary responsibility for admfnistering 
!V^edica,id (^9 states ^et up Medicaid programs, with only Arfzpna not participating). 
While the state welfare agency determines eligibility, it has used* fiscal 
intermediaries (the private carriers) on a contract-basis to handle payments to 
primary care providers. State ^ledicaid information management of these operations • 
has been weak in both its administrative and oversight functions. There have been 
some federal Efforts to 'develop a Model Medicaid Management ^s^rstem, notabiy with 
t leading-ed^^e siate welfare departments in a few states such as Michigan and Maine. 
*' The Automated Client Information System (CIS) o^ the Michigan Department of 

Social Services-, under -development since 1970,- is worth describing her^. CIS was 
originally conceived as one of eight subsystems for imprpving management of Michigan's 
^Vedicaid Program, but the system's data network has now been .expanded, to incliide 
information on all residents who are currently .receiving any form of state social 
services or have received any such benefits in ^the past two years. The major 
objectives of the system are to identify and enroll individuals in social service 
programs J issue authorization cards for Medicaid? furnish necessary recipient 
eligibility information to Medicaid providers*! and centralize maintenance of medical 
and public assistance data, , ' 

The CIS is now the largest on-line J^gjilth and welfare eligibility system in 
the ^country. Each of Michigan's 83 counties is linked to one of five regional 
communications centers by individual videorkeyboard data terminals (VDT's) located 
*in selected couiity offices, state offices and medical facilities and used to enter 
and receive jjpfDrmation from the* statewide data center in Lansing. 'Authorized county 
^ persronneT corftact^the assrgne<i--center VDT operators by telephone when they wish to 

111 ' ' ~ ^ - . 
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submit an inquiry or update data stored in the central computer facility. Telephone 
security checks and' electronic edi.ts are used to maintain confidentiality. 

. Prior to the implement at |on of the CIS, Michigan's Medicaid Program lacked a 
reliable 'data base upon which to make even fundamental decisions concerning ^ 
eligibility and the payment of bills. Through its on-line update capabilities, the 
syste,m no longer rejects nearly 3,000 provider claims each week' as it did under the 
vcdd system, because of processing lags in eUgibili?i/^and re^-eligibility checks. 
The Department of Social .Services also reports reduction of administrative and 
payment costs, facilitation of system audits, and minimization of fraud and 
duplication . - . , ' . 

From a citizen ' ^rights standpoint, ^several^trends in automation ^ong payers*" 
and' intermediaries deserve notice. "As health, insurance firms are accumulating 
automated historical files , on J;heif i)olicyholders , the level of personal medical. ' ^ 
detail in these files has been widenihg. With health costs skyrocketing, insurers 
aild intermediaries are under pressure' to scrutinize claims more closely— 
eligibility for tlie service provided, whether the service is covered by the joolicy, 
whether it^was me'dically necessary and properly provided, whether the chargT^was ^ ' 
within payment guidelines, and so forth. This has led service payers to insist that u 
••full data^^ be 'supplied r positive identification of patient and 1nedj.cal provider, 
exact medical cgnditions and services provided , specif ic medical diagnosis or 
condition. The adyent of. PSRO reviews, and the expected reviews under future 
national health^ insurance plans, create adtiitional pressures'f or collecting identified, 
detailed, evaluative data. 

Clearly the insurance function demands. thai some medical data be furnished to 
payers, not only to determine the appropriate amount of the' claim but to^mcnitor 
for fraud by bpth claimants-^ primary-care providers. It is this demand for detail 
that raises the issue of incursion into the'doctor-patient relationship, /especially 
when the' medical condition involves a socially-stigmatized area or one whose 
disclosure could lead to loss of opportunities by the patient. / 

vVhat has the extensive computer use in Zone 2 done "to observance of 
^confidentiality^n service payment? So fair, not much. The ^rucial aspect of this 
question is uncle air policy definition , which pertains equally to manual records. 
Generally, charges^ of improper leakage of personal data from Zone 2 raise the 
, question I Just what is a private or government employer, or other third party, 
entitled to kno^ about* specif ic medical conditions of a subscriber or claimant? 
-Should no information at all be given to third pEirties on the ground that -health 
insurance farms receive this information solely for purposes of claims adjudication? 
Or sh'ould group policyholders, v/he*%her ^government or private, be. entitled to learn 
of (Certain health conditions that could impair 'Wieir empldyees' job perforinance or 
DjaJce ;them ineli^ble for promotion or sepurity cleki:ances, etc. The point to ' 
underscor*e is that, this is a gray £irea toda^i^n terms of lavt and policy, not one 
on which' law is cldar and 'is being willfully" violated. 

But while leakages of confidential medical data have so far involved manual 
forms,^ not computer printouts, there is little doubt that patient and doctor 
confidence in automatedLservice payment will be. impaired ifv*.jr'?i^^<ii^Q)^lic^es ^ 
prevail. The issue Is whether service payers sftould be collecting and/pr retaining n 
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as much data as they do now, given the fact that many medical and civil liberties ^ 
commentate^ feel they are not limiting its circulatijji *suff iciently in manual 
foi*ms. I ' ' ^ \ , 

Another] trend in Automating service-payment mechai^isms over the past two- decades 
h^ ^een the entr^ of data processing firms as intermediaries under J^edicare and 
jTedicaid, and in various utilization review projects. Among the best" known of .these * 
is the Electronic Data Systems Company (EDS) owned by H. Ross Perot, which processed 
over 75 millj.on health insurance claims in 1973 for various state agencies and Blue 

* Shield/Blue Cross plans. This lodges personal medical data -still fui^ther away from 
the ethical constraints of the primaLry-caire providers or the Blues (which the * 
med_ical and hospital professions themselves developed and still influence directly). 
Given the sometimes politicized chairacter of the contracting process that has 

\ awarded claims-data contracts to commercial firms, and the essentially non-medical i - 
character of these "data " shops, " attention cleairly needs to be paid to how well 
protected these files are today in legal status and how securely they are kept in 
fact. J 

* Utilization Reviews * 

Since health caire is a complex mixture of provider institutions, payers and ' ' 
carriers, and health agencies, rational administration and evaluation depend on the 
collection of statistical data about patients--their demographic characteristics, 
medical problems, treatment provided, ^tcome , etc. Such trend~d'ata ^ needed to^ 
evaluate medical* procedures , plan and administer individual facilities, .and 
coordinate local, regional, or state health resources, * 

For these reasons, a number of^ medical data systems have been developed in 
recent decadea Jthat collect trend infurTnation- through sample surveys of individuals*, 
program-operation data by private payers or government agencies, or case data 
directly from primary care institutions. Such data allow institutions and planning 
agencies to analyze and compare patterns of care, outcome, costs, etc., antf to do 
basic. research. 

The most ii/portant example of such activity is the hospital discharge data 
system for in-patient care activity, of which there are about a dozen currently 
operating. The largest of these, and the only one operating nationwide, is We 
Professional^Activity Study (PAS]^ of the Commission on JJrofessional and Hospital 
Activities,^ ^a non-profit corporation sponsored by the American^ Hospital 
Association, Ameirican College"* of Physicians, American College of Surgeona'> and the 
•Southwestern Michigan Hospital Council. Originally founded in 1953, PAS now ' 
collects individual case abstracts from participating hospita^ls (2100 in 1975, of 
which 1800 are in the U.S.), It provides a database used by the participating 
institutions to evaluate their care and utilization patterns, and projducesliational 
or regional data, for baseline comparisons of many kinds. 

Participating hospitals skim off from their medical records and send PAS a set 
of basic data about each patient disch^ged. This^'covers a coded PAS hospital 
identification, a patient number Supplied by the hospijbal, rtd patient 6r doctor 
identity (these are kept locally "^y the contributing hospital), patient demographics ' 
(a^ge, sex, and race) , .clinical service, date of admission, date of discharge, all 
diagnoses, all operations, form of admission, complications, cOnsultation.s from 



other departments, how discharged or if died, interservice transfer, source of 
^payment (or expected), detailed enumeration of investigations and examinations done, 
drugs used, other therapy, special unit care, and (as of 1974), PSRO information 
relating to certified admission, concurrent reviev^ and similar inatters. In addition 
space on the case, abstract is provided to incorporate additional optional items that 
a EAS participant may want to store and use, such as Jjatient residence, type of 
accomodation within^ the hospital, and special therapy, 

PAS moved into *c<^puter processing in 19^1 and now has Almost 110 million 
individual case abstracts ^stored in its automated database, PAS reports for 
partielpating hospitals are prepared monthly, semi-annually, and annually. These 
provide, .profiles^ of care for medical evaluation, practice display, medical audit 
materials, basic patient statistics, quality of care assessment, and similar 
purposes, as well as regional and national comparisons representing other FAS 
participants, 3pe/:ial options allow a hospital to get utilization and audit reports, 
length of stay studies, stud;) of patient charges, and o/her special analyses, 

There are about 10 regional hospital discharge data systems J;)iroughout the 
United States, such as the QUEST Program of Northeast Ohio, the Hospital Utilization 
Fro.i'ect of Vestem Pennsylvania,' the [^''edical Record System of the California Health 
Data Corporation, artd the Connecticut Utilization and Patient Information System, ^ 
Thei^ arc also projects on ambulatory c^re data systems, and various special-purpose 
<X^%^ systems covering: particular diseases, health conditions, or community health' 
center operations^^^ . ^ • * 

The iasic 'confidentiality principle of the PAS data system is that the hospital 
retains the identity of the patient and'^the ^octor, with the case abstract . filed 
only by a number. The participating TiospitalV^Jcnowing the number, can have Reports 
drawn up on the basis of various grouping of case aFstr^^^^^long any line it 
wishes, but PAS employees and other participating h>ospitals cannot obtain a case 
abstract ^with the name of a patient or doctor on it, t ^ 

Quality Care Assurance 

The 1972 federal legislati^on requiring professional standard^ review (PSt^C) 
under r»'edicare. Medicaid, and Maternal and Child Health Programs^*^ has led to the 
creation of a^ first wave of^^ local PSRO organizations sponsored by local medical 
practitioners. The PSRO • s' obtain data from the various providers— hQspitals , HMO's, 
prepaid medical plans, psychiatric institutions, nursing homes, etc, as well as 
from fiscal intermediaries — and analyze these according to quality-care criteria to 
be set up by the local PSRO, The data systems being developed by these PSRO 
o^TFanizati'ons are automated, and will be linked to the computer systems of the 
providers and carriers, Basic personal data to be included in a case reView are 
expected to include patient identification, demographic data (age, race, sex, 
residential area), hospital identification, dates of service, diagnosjtic data, 
procedures data, patient disposition. -da-fa^ identification and practice' data, on 
attending physician, and identification and practice data on operating^ physician . 

Our project visited several deveJLoping PSI^O organizations and studied the 
data-system plans that they arid others are implementing. From a citizen rights. 
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standpoint, basic issues here irtvolve the disclosure of pati'^nt* identity both, in 
initial peer review and in einy successive appeals that might be taken (including 
appeals that could place identified patient' data in regional or even national 
review files), as well as the patient's right of access to the PSRO record, 

ZONE THREE: COMPUTERIZATION OF HEALTH AGENCY FILES 

We noted in this chapter's Intrcrduction that we -would not attempt to describe I 
patterns of automation in alj^^ie industries and government activities that use 
health data to make various social judgments--in employment, education, licensing,^ 
credit^ life and auto insurance^, welfare, law enforcement, etc, ^hat does. belong in 
this chapter, however, is a description of several important trends in 
computerization by government health afrenties, 've are dealing here not with 

assurance of quality care 05^ government (that has already been treated in Zone^)., 

but with the general planning, evaluation, and coordination functions performed by 
local, state, and federal health, agencies. 

♦Government oversip:ht of hospitals, mental health facilities, and other health* 
care centerfs is a matter of overlapping jurisdictional -responsibility in the United, 
States, f^iven our mixture of private-f or-prof it , private-non-profit, and 
poveri^ment -owned facilities^ plus the supplying of funds to local institutions byo 
federal and state profrrams, there is a mixture of singlg-agency and cooperative- « 
a^-ency supervision that^ puts individual institutions under reporting duties^to various* 
government health agencies, ^ykny of t^ese duties require only statistical data, but 
marry others call for the reporting of identified personal information abOut patients, 
and also the s^upervisory authorities rights of inspection that include access to 
personal records. ^ 

State health agencies occupy probably the pivotal position in^his^ riegulatory 
network, having the primary supervisory authority, over local health f acilities anti^^ 
also servine- as the interfacing unit with the federal government for most local and 
state health-iassistance programs. In a survey conducted in December of 197^,^^ the 
National Association of State Information SystefiTs found that of ^5 states reporting, 
state departments of health in 21 states computerized patient census files; 1-0 had 
patient information processing applications; 10 maintained hospital administration 
files; and 6' had applications for medical records. Seventeen of these st^te 
departments had their own computers, while others- had services supplied by state 
data processinfT centers. ' . t . . 

Another survey in 197^ examined computerization by state mental health 
aiithoritles.^^ Out of ^7 jurisdictions replying, 29 indicated they had implemented 
computer di&ta systems that collected case information from local mentaf health 
centers. Twenty-three of t^hese stored personally-identified psychiatric information 
in their files, either through name or Social Security number. -The primary purpose 
for such automation was found to be the control of costs, with closer scrutiny of 
eligibility th^ key technique. Only three states— Arizona, Colorado, and Uta^)— 
collected no identifying data, while three oth'er states reported that they were ^ 
••moving away from storing identifiable information" in these files. 
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This survey founra t^at "requesting affilrmative authorization for computerizing 
a patient's personal psychiatric information is virtually non-existent," dnly .one"" 
state reported -that loca^ patients »ign authorizations for release of confidential 
information %o the st^ete automated file, and another ^state said ,it obtained patient 
permission to tile the data by* Social Security number /'which is the identifier used 
in this. system,. "If the client refuses to sign a release," this state said, "the 
[local] cent^ jassigns a pseudo-social security nurr^ber to that client's data," 
' The citizen rights issues posed by such state health-agency automation 
revolve around ihe issue of whether such records need to be collected and stored by 
the state with personal identifiers. When these aire attached, this raises the issue 
of iyiforfned patient consent to such use j notice of and control over access to the 
records by other state, agencies (licensing authorities, welfare agencies, police, etc) 
-and^^rifijhts of inspection by the individual patient las to wKat 'is .put in about him 
or her. r-'Jfe already noted (in Part One) the fight that has, erupted over the reporting 
of identified case information by local health and mental health facj.lities to state 
health or welfare agencies serving as administrators of Title XX funds under the 
Social Security Act 's .medical-aid programs. 

One importaht new development in federal law deserves mention here. In 1975, 
Congress enacted the Healthy Planning and Resoutces^e'velopment Act,- providing a 
major 'reorganization of the way that local agencies must set ^ans for and coordinate 
the use of federal assistance -f-5i3s the health f-ie-ld,^^. The Act tenijinates the 
existing structure of regional medical programs and comprehensive health planning 
agencies ^and calls for the creatl,on in I976 6f 200 health service areae in the United 
States. Each will be adpiinistered by a healtfi service agency that can be a private 
body, a non-prof i.t organization, or a^public agency', depending on Ipcsil option, 
thoufTh it must then have -in it representatives of the facilities and agencies 
^receiT?ing federal '^id in^^that area, ^Thi^ has set off^a lively struggle to see 
whether doctors, l^pital administrators, consumers, or local health officials will 
dominate the new agencies , -and different solutions may emerge throughout the country. 

What is important for our purposes is that the "arc t requires each ofW:he 200 
agencies to create a data base on the health status of its residents j an inventory 
of local health facilities, personnel, and services; the organization and operations 
of ihe area's health de.livery ^system; patterns of utilizatio/i; the efTect of thai ! ^ 
system on health; and its impact on' environmental and occupational-exposure 
conditions. This represents perhaps the most ajnbitious^ effort to date by the federal 
government to develop comprehensive, statistics for evaluating local health'^systems 
(both ^9 whole units* and for specific treatment "problems) and to get a national 
picture of health conditions. Guidelines still have, to be i*ssued" by HEW as to how 
these data systems will operate, buf the issues 6f identified versus statistical 
data^r Controls over data^ circulation, and patient Jieccess clesirly lie ahead. 
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A NOTE ON PHOTODUPLICATION AND CITIZENC RIGHTS 

Though our primary focus in this Part has-been on computers, we must stress 
that there is another important inf orrnatiQn,.technology that is affecting^ health-care 
records* ana citizen rights--photoduplication. Until the 1960'sl most hospital 
patient records were kept as original paper documents. .When third parties wanted 
copies of these records, for claims purposes*, litigation, etc., .the medical record 
department' would abstract the relevant portions of the document, with- only rare use 
of the cumbersome and expensive photostating me^od. 'Records were also subject to 
the control of sign-out and sign-in prdcedures^ With the 1960's, xerography 
arrived? today, \^s estimated that over 70^ of hospital medical record 
departments own photocopying equipment, and supplying photocopies of records has 
become standard procedures, pricrof ilming also ;iarrived in the' l96d*s , and as js^ace 
problems became more acute and c'osts of microfilming wen-Pdown, many * hospitals put 
their records, especially inactive records, onto microfilm storage. 

The importance' of these trends in^photoduplication for citizen rights is that 
the pressures on medical record administrators to comply with requests by service 
payers, insurance companies ^ and government reviewers o'ften leads them to photocopy 
or make a microfilm print of the entire medical record, or at least an entire page, 
even though the information requested by a third party, or to which such party is 
properly entitled, may only be a portion of the patient record. The costs of 
locating the relevant' data, masking out parts not pertinent, and explaining such 
procedures to the requesting parties are often more than overworked records 
departments can expend. In ad^dition some medical record departments allow service 
payers and- insurers who can show patient release forms to come to the record 
library and do the photocopying themselves, paying for the use, of the hospital's 
photoduplicating equipment. Where this is done, such third parties handle the 
patient records th^selves, and the capacity for breaches of confidentiality are 
increased. €lso, when persons with a r'^l^to sign out records take them,^the 
ubiquity of " photocopying machines leads to an ^inability to' control copying, and 
further copying. from those .copiers. , ' ^ 

Heatth ^cbrds administrators have recently criticized such developments as 
jeopar4izip^^ cpnf identiality . " But they note that the tremendous increases in 
required reporting, the shortage of staff to apply> more restrictive procedures, and 
the widespread use of sweeping patient releases ("supply any and all hospital 
records.../') make it difficult for the^ecord administrators to deal with this ^end-. 
on 'their own.*^^ ^ 

^ ' . * i ' SUM^'iARY 

Comptitei-ization of 'personal medical information has been marked so far. by 
haphazard growth i it has not developed'* according to thoughtfully conceived plans for 
achievin^r integrated health information systems within individual facilities or 
thrc^ughout the health care field. At the same time, policy^as to the citizen 
ri/rhts issues of privacy, confidentiality, and>, access is also developing on an 
individual, ad hoc basis, for the most part simply carrying, over' into computerized 
files the same practices pursued with manual records. * ;rhe basic concern of health' 



;car*e professionals, civil liberties observers, and computer experts is this: 
given the more detailed, moofe centralized, mor*e permanent, more easily-transmissible 
^ quality of computferized medical^ records , the flay/ed procedures and policies 
currently employed with, respect to manual records threaten to be seriously 
inadequate to the computer era, * , 

4, ^ i 
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INTRODUCTION, - • - 

^ Having mapped the ^neral trends in tjomputerization of medical daj:a, we turn ^ 
now to profiles of six organizations currently involved in automation projects ♦ 
These are: ^ ■ ' 

Los Angeles County Medical' Center i " ' 

2. Ma3*tin Luther King^r, Health Center, in New York Cityi 
3* Kaiser Permanente HeWlth Plan, OakTand, California i 
4. U.S. Indian Health Service i 
5* Mutual of Omaha Insurance Company i 

6* Multi-State Psychiatric Information System, in Rockland County, New York* 

Our purpose in presenting 'these case studies is to explore how organizational 
factors, especially choices as to -health-csure goals and administrative philosophies^ 
are shaping bot.h the utilization of computer technology and the consideration o$ 
citizen rights. , ^ " ' ^ ^ 

As .to computer utilization, producing detailed profiles is important because the 
deployment of computing and communication resources is still essentially a matter of 
organizational artistry, not management science. The development of computer systems 
requires managers to exercise choice in selecting the files and data flows to 
aiitomate, sirranging configurations ot hairdwaire and terminals, writing softynaxis^ 
defining operator-machine relationships. Betting patterns of data-sharing inside and 
outside the organization, deciding on levels of organizational monitoring,. and 
reporting^ and ^hoosing^'^he type of individual consent and patient access, if any, 
that data subje.cts will be given. \jnderSt$uiding such choicefe is greatly aided by 
amalyzing how real organizations have apjj^o^ched such matters Muring the past decade. 

From a citizen rights standpoint, the ijnportance of doing profiles lies in 
tracing'how issues of privacy,, confidentiality, and individual-access were treated 
by these organizations befiore they moved into automatioiij how computer Axse has 
affected tho$e practices.1 how on-goifig. changes in American law and social norms are 
dr^ecting management practice si and what problems and issues of citizen rights 
are currently unfolding in these organizations, or can be seen looming ahead as 
computerization expands. / , 

Foifr of the^e organizations sire primary-care providers in our Zode 1 category i 
one is a Zone 2 private healtli insurer f and the 'sixth is a Zone 3 research 
organization, ^ ' ^ . ^ 

While it is impossible to reflect all the significant variables among health- 
care organizations in six profiles, we have tried to include most of the .important 
oijes. The following chairt gives a preliminary overview of these « 
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CHARACTERISTICS OF PROFILED ORGANIZATIONS 



ORGANIZATION 


CLIENTELE^ 


3WNERSHIP 


TYPE OF 

COMPUTER 

USE 


ibAiioJV (5r— 

HEALTH CARE 
OR SERVICE 

=^^^===^= 


TREATMENT 
OF 

CITIZEN 
RIGHTS 


LIKELY 

PROSPECTis lU 

COMfOTER- 

IZATION 


L.'a. COUNTY 
HOSPITAL 


Urban Poor, 
Minorities 


Public, 
County ^ 


^Mainstream" 


Good 

Emergency 
Facilities, 
Average For 
Other 
Services 


Fair 

To 
Weak 


Continued 
Mainstream 


MARTIN LUTHER 
KING CENTER 


Urban Poor, 
Minorities 


Private , 
Feder^- 
Funded* 


"Mainstreain'! 


Good and 
Innovative 


Good 
To 

Excellent 


continued 
Mainstream 


KAISER HEALTH 
PLAN 


Mi^di^w 
Class, and 
Uni oni 7prf 
Workers 


Private , 
Non- 


Advanced 


Excellent 
and ' 

Innovative 


, Good 

«^ 


Continued 
Pioneering 


INDIAN HEALTH 
^ SERVICE 
U 


Rural Poor 


Public , 
Federal 


^Advanced 


Innovative 
But Weak In 
Outcomes 


Fair 


Future 
Uncertain 


MUTUAL OF 
' OMAHA 

INSURANCE 


Primairily 
Middle and 
Upper Class, 
So^e Lower- 
Middle.' 


Private , 
Profit 
• 


Advanced 


Innovative 
and Strpng ^ 
As Insurer ■ 


Gojod ^ 


Coniinued , 

Advanced 

Use. 


14ULTI -STATE 

PSYCHIATRIC 
';.INFORMATION 
''SYSTEM. 


Multi-Class., 
in Different 
User 

PacJ.lities 


Public, 
State 


Advanced 


Innovative , 
In Systems- ' 
Development 
Work. ' 


Good" 


Probably 

Continued 

Pioneering 
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To develop the profiles, our project reviewed patterns of automation with 
marketing experts" from three computer m^ufacturers , We also collected published 
descrip-^ions of <^ver 150 organizations ♦ Once we had made our selections, we wrote 
to the organizations describing pur project and asking to do a site visit to them. 

After materials about each organization had been assembled and studij^(l^^^teain 
of staff members visited the -organ iz at iorf during 197^ and 1975» usually for an^ 
initial visit of" 2 days with follow-up visits^ and telephone calls as needed, A 
draft profile was prepared and sent back to each organization so that facts' could be 
checked and policies further explained. Updating jof developments f^or alj. six 
organ izgit ions was done through Februgtry of 1976, (The organizations' managers were 
not asked to approve the descrip-tions or judgment^ presented; what appears here 
represents the Views of the project teams who did the initial write-ups, .and the 
project diTT'ector, who did the final revisions , and ^rewriting. * 

After each profile, we haVe inade some observations about the.icey citizens right 
issues pbsed by the health-cepe philosopl:iy and computer usa^ of that oxtganization, 
Thes^Bberve as flags for our main policy disqussions and recoWendations, which are 
savei!jror the last' chapter of 'this report, 



126 



CHAPTER 5 LOS ANGELES COUm MEDICAL CENTER 

The Lob Angeles County Medical Center seyves the urban poor. Like many other 
governmental institutions in the city, it s,truggles against the burdens of un(^erfi- 
nancing, personnel shortages > overcrowdings aj2d a medically-haurmful physical and 
social environmen,t • In terms of citizen rights > it is part pf the current urban 
governmental system > one more institution that has come under attack for ijif ring- 
ing upon peoples' rights in , the name of doing them good or providing them with social 
services. While not among the most adveuiced computer users , Los Angeles has been 
developing a patient data bank that was planned to bring significant improvemefi^s to 
patient care and education. How its computer use, and its general administrative 
policies > affect citizen rights will be the focus of our profile. 

V. — 

Background / ' ♦ 



Medical Center is part of the Lbs Angeles County Hosprfal system, which serves 
the 500 square miles of the city and its surrounding municipalities. It dates back 
to 1878^ when it was begun as the Los Angeles County Hospital and Poor Parm, with a 
100 bed facility. Today > with any of the county's 7 million residents" legally en- 
titled to reserve care^ thq system h&s nine* county hospi^ipls and eleven outpatient 
clinics and rehabilitation centers > as well as 62 clinics run by the Community Health 
Service. In fa6t> most of the county patients are poor and members of racial minority* 
groups; those ijtho canrtot afford either private physicians or private he^th plans. 
' Only for emergencies , (such as auto accidents) and for specialized care (communicable 
diseases) does the Ccrimty ^system serve the middle class as well. 

The ^edical Center is composed of four hospitals*in East Central Los Angeles, 
with beds for 2,000 patients. It is a huge complex; over 90,000 patients admitted a 
year and 850,000 outj^tientff. It employs more* than 1 ,000 interns, residents, an^ ^ 
full time physicians^ 70^ of these are interns and residents from the University of 
^Southern California Medical School, with which the center is affiliated as a teaching-* 
institution. The center also has 1,800 nursing personnel and over 5f000 other health 
workers.' The labs complete more thaii 7 million test measurements each y«ear, includ- 
ing more .theua 1 ,400 X-rays every day. About 20,000 surgical procedures are performed 
in a year. In 19.75* the center'^ budget was approximately $300 million. 

The Los Angeles County System, like many local-government hospital systems, 
has been criticized in..rece^ai_^ears for not providing adequate care euad^or showing 
insufficient respect for patients* dignity in processing them through the hospital. 
In 1970, for example, a group of interns 8uad-;i^i*ei^s charged that lack of care at 
the Medical Center had resulted in unnecessary' patient deaths and injuries.' 

•( \ ' ^ ^ ^ 

♦General Hospital, flwomen' s Hospital, Pediatric Pavilion and Psychiatric Hospital. 
The >jbo,t&l inpatient adiaissions for Los Angeles* nine hospitals in 1974 was almost 
200^000 anS'overJ>rl(8 million oatpatient-^7±slts.,^Xt-has-over 2 million square feet 
of hospital space knd a total staff of 3,000 physicians, 2,000 students, 2^000 nurses, 
and 8,500 employees. \ 
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The jCjDtjanty lipspital Commission investigating, the charges concluded that they were 
exa^erate,^, but acknowledged that serious patient care problems did exist • More 
recently y 4 study commission found that while the general level of care was adequate , 
"It was not evenly distributed throughout the county, and discouraged people in poor 
areas from securing the kind of routine care they need. Criticisms of fiscal mis- 
management have also been raised. Hospital officials respond that the County Hospital 
system has corrected the problems cited by*^ts staff, and does a good job considering 
how severely funds are limited to it. They also maintain that its administration is 
basically good, and better than at most municipal or county hospitals. Both hospital 
physicians and the system's critics agree that emergency care .at the Medical Center 
is" excellent; • 

The County hospital systepi has a budget of approximately $300 million. Less 
than 10^ of this comes frtHn out-of-pocket payments by patients or the private insur- 
ance coverage they pay for. The remainder comes f^rom taxpayers, either through di 
rect County support or state and federal programs such as Medicare and MediCal. 
recent years, the hospital has felt increasing pressure from the County to pass the 
costs of care on to individual patients ^or to state and federal programs for which 
they are eligible, and this, as we will see, has affected computer uses there. ^ 

^ Computer Development at Los Angeles Medical Center , j 

"Between 1562 and 1966^, several studies of health information system possibili- 
ties for the Los ^ngeles area produced plans for a pilot data bank project at the 
Los Angeles Medical Center, An on-line admissions system went into operation there 
in late 1968, and was adopted by the county .hospitals by 1970. 

The qroject had four ohjeotives at this point: (1) to capture all patient data, 
and utilize the system primarily for patient care and research rather than the more 
usual financial and administrative objectives; (2) to develop the problem-or^-ented 
medical record pioneered by Dr. Lawrence Weed; (3) to develop a MedicAlert system to 
flag by terminal a warning of preexisting conditions whenever a patient's record was 
cailed up; and (4) to provide the basis for linking the Center's medical data with out- 
side hecLlth agencies for* research, evaluation:, and planning purposes. ^ ♦ ^ 

Creation of a Patient Data Bank and achieving terminfiO. communicatito among the 
nine county hospi.tals became the main emphases of the plan in the early 1970' s, 
through a gradual accumulati&i of records and a "modular growth" oif computer' applies^ 
tions. By 1972, about half of the County's 2.5 million records were computerized, 
with 1360,000 of the Medical Center's 1 million records on the computer. A.dmissiond 
and Lal?oratory applications were the first to be d^eloped, followed by a .fiscal * 
system eu;id,a pharmacy application. ; 

Funding for the computer project has come from Los** Angeles County,, not outside 
sources. It averaged S3»5 pillion annually from 1968 to 1970, and about 15.5 million 
since- 1 971 . ^ ^ ^ * ^ [ ^ " i 

Basically, the Medical Center computej? lyppject produced* computer-a'sfi^istance 
for what is still essentially a manual record system, using paper records, ^shelves,, 
file caliinets,' and messenger services. To understand how this system works ^ we look 
first at the admissions process and then the use of patient recortts within ^the hospl- 
tsOL. for treatment purposes* « 
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The Admissions Process 

When a patient enters the Center, either through the emergency room or admit- 
ting araa, an admissions clerk secures as much identifying information as possible: 
name, address, Ace, sex, mother's maiden name, religfbjj^ birthdate ant marital status. 
Social Securitrnumber and (iriver»s license number ire collected to serve as back-up 
identifiers^ If the patieTnt already, has a hospital identification, a Medicare, or 
MediCa}.*card, or an enrollment card from a private^ insurance plan, the clerk notes 
the numbers, . ^ - 

Identification j ^ ormation from the Patient Information Form i^then entered 
into a computer system-via one of tlje video-display terminals in the adjiitting area. 
Six to ten seconds later, the screen displays a list of names, addresses and birth- 
dates of recent past patients who most closely match the new patient, ' The clerk looks 
for a- close match, and if he/she finds, one, prints the information about that patient 
on the Application Record and makes any necessary corrections of the permanent record 
(e.g. chan g e of address). 

This Identification system contains more than H million names. Roughly 40?5 
of the in-patient admissions are identified as having previously been ,to a' county 
hospital facility. If the patient is not identified as having been a previous County 
patient, the clerk calls the identification section of the Medical ifeoords Department 
and gets a new r.ecord number'for the patient. ^ " s . ' 

- The primary purpose of the Admissions/identification system is- to determine 
what individual or agency will pay for the patient's medic^ care. Tbe need for an 
immediate determination of who will pay must, be seen in the context of how the Medical 
Center is financed: 

1 . Private payment; Only 10?^ of the patients have private insurance or suffi- 
cient income to cover all -^heir bills. The 'bills -are substantial^ .outpatient treat- 
ment in 1974-75 was billed at roughly 130 a day plus the cost of Ub tests, pretskp- ' 
tions and other "extras"; inpatient treatment averaged $184 a day, with surgery" billed 
at $290 a day, intensive care $420, and psychiatry $165. 

2- Medicare/MediCal; Approximately 53% of the patients are enrolled in Medi^ 
care or Medidal. The Social Services. department fills out the appropriate forms for 
these programs, copies of which go to'the agencies involved. The patient is billed 
for any deduc.tible portion that is not covered by these agencies and the agency is 
billed for the rest. / 

3. County Support; Approximately 35< o***h^ patients are not enrolled in 
either a federal or state program and claim they .cannot afford to pay out of ^private 
insurance.^.or their personal income. The funds to support the care of these patients 
come from the tax revenues of Los Angeles County. 

There is strong ^pressure from the County to reduce its 55JS support by (a) iden- 
tifying ever^ possible patient who is ''eligible for either state or federal aid, apd ' 
(b) correcting f^es from all those w^o are ineligible and have some financial ^re- 
sources. The collection of identifying data upon ajifoission and the comparison with 
the past h9spital^ec<>rd is the first s.tep in assuring accomplishment of these two 
ends. ' \ 

^ V-— • - ' ■ ? - , 

h^diCal is California "^st^te supplement to Medicare. 
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• 'Where tKe patient 'is not covered by state or federal programs, an effort is ^ 
made by a Financial Services Worker in a personal interview to find oat whether the 
patient is eligible for either by collecting information as to his/her financial, re* 
sources, including income, personal and real property, savings and other assets, 
which the patient must swear to and document by the production of pay stubs, bank 
books and other records.^ Patients who are eligible for federal assistance and who 
earn too much^money to qualify for county assistance, or who refuse to provide the 
necessary financial information, are billed in' full for hospital services, on an 
installment basis if necessary. 

Since June of 1975r Medical Center hospitals have been tied into a commercial 
billing service operated by the IfcDonald-Douglas Corporation. Information is ex- 
tracted from the admissions forms^and entered into this system via computer termi- 
nals in the business office of each hospital.^ The^ information is processed in Peoria 
Illinois, and billa for insurers and patients are printed out at the hospital. In 
addition,' ^aily census reports are prepared for each ward and a variety of. sWtistic- 
al reports are produced for administrative purposes. , ^ 

As it now stands, the billing system conttiins information on each patient's 
age, sex, rkce, family background, ward and source oi^paymdnt — in addition to basic 
identifying information. In the future, according to Medical Records Director Bliss, 
the system will aSLso conts^in information on diagAoseS and medical procedures — the 
full range of medical ^Jif ormation^TR^quired for report'ing to insurers and government 
agencies. - ' r , ' 

The unpaids bills of patients are turned over by the Center to the County Bu- 
reau of Resources and CollectJLons , whose functions include collecting delinquent hos- 
pital bills for the entire hospital systems The Bureau pressures the patients to pay 
and where this doesn't succeed, they refer the matter to the County Counsel's office, 
which can take the patient to court, attach personal property, or place a lien on the 
patient's house or land. Because this is time-consuming, it is done on a selective 
basis, primarily to give credibility to the enforcement process. 

Medical Records and Admissions workers estimate that about 5^5 of patients give 
false names and/or addresses, and only occasionally* will such false identities be un- 
covered. Some patients do this because they are afraid of the hospital bills , ^others 
fear deportation illegal aliens, and still others do nOt want to be stigmatized by 
an illegitimate birth or venereal disease. 

Despite current collection efforts, reimbiJfcs^ent for County medical services 
remair^ a chronic problem. In July of ^1974, the Audit Committee of the County Grand 
Jury handed down a report criticizing the Bureau of Resources and Collections. The 
report noted at least million outstanding in delinquent hos^^a;L bills, and sin- 
gled out Medical Center's Emergency Room billings as being in p^f^iciilar need of im- 
provement. • The report, called for more effective collection pro^diires to be estab- 
lished^^uch aa billing emergency room patients at the time of treatment and more 
quickly id.«atifying those eligible for.MediCal. 



It should be noted that the .Medical Center must accept any acutely-ill patient, 
regardless of financial cona:ition. ' The Centfer has tried to' delay treatment in non- 
emergency cases until it .found oOt who was going to- pay for it, "This was abandoned," 
said John^McClurg, the Center»s Medical Service Admaj^ptrator, "because the addition^ 
al revenues we got "by\this_ method didn't balance against making the patient wait 
longer." . ^ . • ^ 

In addition to its payment function, the admitting form also serves medical 
purposes, and tkese have been enhanced by computerization. For example, the Center 
has special information' on 8,000 Med i-Alprt patients which can be printed out bn the 
application record; this warns the staff about these patient's special medical -pro- 
blems. If a patient is a diabetic, for instance, a code number ajppears on the Ap- " 
plication Form that places the patient in a special ward. Or if'a patient has a ' ^ 
pacemaker, a phone number will be provided for specif instructions. 
The Patient's H|^ical Record Within the Hospital 

When the admission procedure is completed, , copies of the application record 
are sent to the Department' of Medical Records, the Chaplain's Office, the Data Pro- • 
cessing division, and Patient Billing, It is also attached to the patient's chart*-^ 
a collection of laboratory reports, X-Ray results, diagnoses, etc. - which is com- ' 
piled for immediate use while the patient is at the hosi>ital, ^hese individual pa- 
tient records are^kept manually. 

A physician may call for a previous patient record stored in the record c§nt^ 
to be produced for use in this treatment episode. This is not done automatically, 
however. Accordilig to Andrew Bliss, Director of Medical Records, physiciai^^request' 
a search for prior records on ^nly a third of their^atients. there are^several rea- 
sons given for this limited t^se of past records: "^"^^ 

1) They are not always delivered as fast as the physicians "need them, al- 
though Medical Records Director Blj-ss states that they are usually delivered "within 
thirty minutes after a request is made." ' ' * ^ 

2) The needed information must be laboriously extracted from the collection 
of paper forms, notes^ and X-rays that make up the patient's permanent medical record. 
"Right now, we have no economical way to do this," reports Professional Services Di^ 
rector Sol Bernstein. A survey by the Chief f^egis^trar of the Center indicated that 
even yhen the past record is requested, physicians on the ward look at only 3^ of 
the items on the 'chart. 

. 3) Identification problems sometimes result in the wrong record being deliv- r 
ered or information on morj tijan one patient being included in the' same record-. 

4) Physicians often will no% accept the "work-up" done on a patient Ipri or 
td the current admission. Dr. Bernstein points out that "A physician here will 
order a new work-up even if the person was recently a patient in his own hospital. 
It's' a c6mbination of 'careful medicine and mistrust of th'e othej- manls work." ' 

Some of these difficulties, are'^flected in the fimiifigs of outside review 
bodies. ^In 1972, the Joint Commission on Hospital Accre<Utation withheld the-^Me^di- 
cal Center's normal 2-year accreditation. The decision was based in part on record- 
keeping shortcomings, includihg. failure by physicians to sign requests <ln patients', 
files for treatment and X-rays, failure xo-^complete discharge summaries and opera- 
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tion reports on time, and failure to establish a sufficient number of audit committees 
for internal review of the staff* s work. A year later, however, .the Commission found 
many of ti^e r^cprd-keeping deficiencies corrected. The State Department of Health, in 
reviewing the Medical Center, has also" commented on improperly signed orders for treat- 
meAt and failures to identify patients accurately. * 

Whether the ch£u:t is a new one, or one continued from a previous stay, this^ 
chart follows the .patient. If the patient is admitted to a ward', the chart is deliv- 
ered there\ and is stored on a rack outside the nutsing station* If the patient moves 
to another ward, the chart follows along. " "We* re talking about an enormous demand here 
• ..moving hundreds of large records around every day," comments Mr. Bliss. 

The Growti^ o? Counter Use at the Medical Center ' S, ^ 

Why did Los Angeles County move into' electronic data processing? In the late 
1950|s,' the Medical Center began to convert its payroll^ and patient billing from manual 
to machine processing. "As 'the workload grew," said Gene Thompson, Chief of the Health 
Information System, "they just kept developing along proven lines, adding more of the 
same kind of equipment until thej^^ad a big tab shop with perhaps 75 people."* 

In 1968, following acceptance of the computer studies mentioned earlier, the 
Medical Center acquired an IBM 560/40 and bQgan converting its admissions system. By 
the end of the year, onr-line records for 65,000 patients were available a-f the^Medical 
Center yia^ twelve terminals. Developing this system did' not Involve converting much 
of the* data from*existing msinual files but , was designed to build its own data base 
over %Xme. Use of the System created the list of past admissions against which current 
patient identt^i€j;^s are checked. o < ■ - 

In 1959, the Data Processing Department began to expand the system beyond the 
Medical Center complex to all nine county, hospitals, and to the pr.esent 120 terminals, 
and almosf two million patient names. The MedicAlert previously mentioned was created. 
A variety of administrative 'and statistical reports^are also generated from data al- 
ready in the system or especially in- put for processing. ^ * , ' 
In addition to the functions of the main computer, several stand-alone computer 
systems developed independently. Among the separate systems are':" (1) processing and 
reporting blood gas analyses and electrocardiograms ;jt2) keeping track of X-rays; . 
(3) patient-monitoring at Women^s Hospital; (4) scheduling clinic appointments; (5) keep- 
ing track of the hospital «s 2,000 non-president attending physicians; (6) keeping t;rack 

f prescriptions and drug use in tlSe pharmacy ; (7) monitoring vital signs in ^ the cardiac 
'intensive care unit; (8) statistical and administrative information about patients with 
communicable diseases "and^mental health problems. / * 

Acceding to the Health Infonnation System*s chief. Gene Thompson, most- of these 
system^ developed out of very, specif ic needs and were "shepherded by one or two people^ 
Jfhq could make a case for getti^ the money. Almost all ^f them weite developed in- 
•hou^e in an ad-hoc fashion. . They •re nSt part of some grand design." 

Lack of research and development money seems to be tha chief reason for this ad- 
hoc development of computerization, J^T. Thompson Recalls that "...we had to develop 
applications that showed pay-off because most\of the money for develo"pment came out of 
the Cou^ity. Even though the environment ^itn the County w^s pretty encouraging •for BDP 

— Medicare and MediCal dollars had just started flowing , in ^ — ' we had to develop very 
♦ ♦ 
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practical applications. Ve knew from the beginning that we were going to develop a sys- 
tem^ that would grow slowly and that would change over time. This kept us from even think 
ing about putting it air'togethpr in one big 'hospital information system.*" 

Both McClurg and Thompson. point to a second constraint, in addition to the lack 
of money, ~ the early focus on serving multiple hospitals made them-re^cf the idea of 
building a system to handle all the records on ali patients. "There was just too much 
^ there; it was clearly too complex to do all at once," said Thompson. "So we thought in 
termfe of being able to do the* job both manually and on the computer. We vowed never to 
try and replace the whole cJhai^."- , 

' Hospital personnel interviewed believe^ that the computers save time, improve re~ 
cord-keeping accuracy, and provide better administrative handling of patients and their^ 
records. As to the Admissions/Identification system, Thompson states that "The average 
admission time has been cut from 15 minutefi to /ive or six..,In addition, admissions 
forms which go into the patient's chart are more standardized and have fewer errors than 
in the past." Computerization has also enabled County hospitals t© achieve some limited 
01*0 s*s-referenc ing of patient files. One of the early problems encountered was that a 
clerk in one hospital was able to introduce errors into the files of another hospital* 
When this kind of error reached intolerable levels,' the system was changed so that a 
terminal 'user *in Hospital A could read but could not add to' or alter the identification 
files of Hospital B. ;^ ' 

Since the Admissions/Identification system links separate medical records, but 
does not create a consolidated record^ from several sources, its opera-^ion has had little 
effect on the accuracy of those ^medical records which still depend upon manual entries. 
A review of the Medical Center computer system found' that: "Level of efficiency in link- 
age was considered good, but only as good as the .actions of people who bac^ up the sys- 
tem and the quality of the service given as a result. Quick and accurate reference to' 
the medical record... was considered futile if the record was not completed accurately, 
not filed currently in .an accessible manner, and not deliverable within a minimal time 
lapse." ' . • ^ * *^ 

Two important mediced applications currently being developed are a laboratory 
data managemen^t system and an expanded pharmacy system. The laboratory system, under 
development for the past six years, includjes both analogue and digital processing. The' 
labs at the Medical Center are now fully automated and hospital officials describe them 
as the largest clinical testing complex in the countiy. Over, 1,400 kinds of tests are 
performed, for a total of 7i million procedures each year. The diversity and volume 
hav6 proven difficult to handle, but Thompson expected that a sys'tem to pi^nt out* lab 
results summaries on demand in the admitting W emergency area's, and report these to . ^ 
the patient's ch^rt would be'. ready by the end of 1975. At first, this system will serve 
only the Medical Center, but will ultimately be expanded to all the-acute hospitals. 

The goal of the pharmacy system is to focus^ the physici^»s attention on ovei^use 
of particular drugs, bad drug combinations, and patient Sfiisitivity to medications. 
"Basically, the system will tell the physician what the preferred drug is for the diag- 
nosis. It will also ke^p the patient's drug histoid file up to date and check to see if 
the patient has ever had a reaction to the drug pre'Scribed. " 
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Citizen Rights Issues . * ' - 

. We noted earlier two basic aspects of the Los Angeles systems that frame its 
treatment of citizen rights issues. First, mosy^ayte poor, member^ of racial minority 
groups (primarily black and Chicano), lils^ly to be dependent on welfare and other 
county social services, and often of low or little literacy. Second, the lit>ajDi tal sy s^ 
tem is understaffed and over-worked, and its patients* medical problems are often the 
result of urban poverty and social neglect over which patients and hospitajj^taff alike 
are powerless. The sitiration resembles closely what the documentary -filmmaker Fred _ 
Wiseman found when he^dM a film on Metropolitan Hospital in New York City. Wiseman* 
went expecti.ng "to find a lot of bureaucratic callousness and a hardened staff, indif-e 
ferent to the problems of the poor. What I generally found, tho'ugh, were a lot of doc- 
tors, nurses, and hospital personnel wha^really cared" but were basically unable to 
overcome the "medical consequences of bad housing, illiteracy, no jobs, malnutrition, 
and so on." When issues of rights such as privacy, confidentiality, and patient access 
to records arise , the prytlems are further compounded becaus^ many hospital officials 
regard these as "frills" and "expendable" matters, and many patients in a place like 
Los Angeles Medical Centar simply do not know that they have any rights at all. 

Confidentiality / 

As in other '^hospitals , Medical Cent^^r personnel begin. with the conviction that 
a patient's medical data is "confidential." But exceptions to this rule come in legions.' 
When the patient is admitted ,' except in emergency cases where the patierit is unable to 
do so, all patients or their legal guardians must sign a General Consent form before 
treatment begins. ,.The 'patient "agrees to" whateve'r tests and medical procedures the 
hospital staff deem^ necessary, including discharge to another public medical institu- 
tion. Sino^ this is a teaching facility, the form also specifies the patient **s con- 
sent to "demons t rat jion and/or observation" by physicians,* medical students and student 
nurses. Finally, the patient ^so formally consents" to J' .release of medical informa- 
tion to other institutions or agencies accepting the pktient for medj^cal or institution- 
al care; (and 'to) patient's insurer." A copy of this form, which is in English and 
Spanish, is given to the patient, and the origiixal is attached to the patient's chart. 

We halve already noted some of the \fays in which outside non-medital personnel 
obtain access to patient information at Los Angeles Medical Center, such as the joint 
Commission orf^Hospitsil Accreditation, which conducts chart review for accreditation 
"purposes, or the State Department of Health, wjii'ch also conducts chart .review as part 
of its yearly inspection routine. Among other outside non-medical agencies olg, individ- 
uals who sl^are patient information are the following: 

1. Insurance, Medicare > MediCal . Each: month, approximately 4,000 reportL go to 
privtite insurers, and to C^S^ifornia Blue Cross which acts as intermediary for Medicare 
and MediCal. The claims form includes a brief "discharge summary*^ - dates of admission 
and discharge, ^Tiagnoses, a history of the problem and a list of surgical procedures. 
Similar information, in' somewhat greater detail goes to Blue Cross for its owij use. 

*^You Start Off With A Bromide: Convers^ation with Frederick Wiseman'," The 6ivil LibeiN - 
ties Eeview . ninter^pring, 1974, Vol. 1, No. 2, 57. 
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The claims forms are prepared from the patient's* record, drawing on the physician's 
formal discharge summary^ Where no disc^harge summary has been , prepared (the iarge^ back- 
log is a' chronic problem) a summary is constructed from recent materi^s in the record. 
The general consent form that the patient signs uponjad^ission covers the release of 
this material. In addition, most patients sign a release as a condition of receiving 
state or federal aid or private insurance. >• . * -r- ^ 

' ^* Employme nt, security, life insurance » disability, investigations . The Medi- 
calNlecords Department responds to about 18,000 a^hoc requesW a year for infoi^tion 
from patient records. The inquirer generally has Sa'^authorization form signed by the 
patient as part of his application for insurance, filing a disability .claim, employment 
application, etc. An average of about one request a month is turned down, generally be- 
cause the inquirer did not have the proper, authorization. 

' A*records department worker describes her job this way: "They come in and we 
make them sign the lo^ we kfeep of all the people who look at records. Then we're' sup- 
posed to check the patient authorization form. If it is more than six months old, we 
refuse the request. When we locate the record, we check the signature on the form 
against the patient's signature in the record. Then we either type. out a summary for 
them or let them sit down with the record." The hospital will copy a record only if it 
has b^en subpoenaed, but lawyers and insurance company representatives often bring 
their own copying equipment to the Medical Records office, and are generally allowed to 
use it. 

> 

Routine claims-information requests concerning psychiatr^^c treatment are handled 
like other medical treatment requests. But requests from lawyers, or from insurance or 
employment iilvestigators , require the Assistant Director of Psychiatry to authorize -t^, 
release if it seeks anything more than dates of admission. ^ v 

"Most of , the requests we turn down are. in the mental, health area," says Medical 
Record Director^Bliss. "Let's say a man applies for a job and he.3/as treated here ^ive 
years ago in the psychiatric service., The Assistant Director might refuse to release a 
discharge summary if he feels the person's problem is not relevant to the job applied 
for. The job applicant'may hayf signed a release,, but the law allows the psychiatrist 
to refuse the information if he thrhk^it is in^the best interests of the patient to 
do so." N ^ ^""^^^ / 

This may create a dilemma: "Sometimes we get a security investigati^ case,^' says 
Mental Health Services Head Clyde Johnson^, ."where we stand to hurt the patient if we 
1 release the information on file — because it might* be misunderstood. The investigator 
can assume that since the patient has signed a release, butt we have refused to give it, 
information must be really bad." 

Public Reporting; Requirements : Physicians are required under Cali-fornia law 
to report injuries they think were the result of a criminal act, either self-inflicted 
or from violence by another person. Assistance Medical Records Director Faulkner 
states that "Jtfh'fere it is the pl^sicifan (rather tjh^' the police)'wko discovers a Tcnif e 
wound, say, or a battered child, he just notifies Setcurity and they notify the-los* 
Angeles Police." — ' • • * 

Communicable diseases, such as V.D., and drug overdose cases, must be reported 
to the Departmenjb of Health on standardized forms. In the case of V.D.', although the 
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^ Health Department follows elaborate procedui'es for protecting the confidentiality of 
those on whom they follow up, there is* wides;pread resentment by Los Angeles County ' pa— ^ 
tients against the mandatory reporting, since it is widely believed that the' private 1 
Pi^si^^ans who treat the mor^ affluent protect their patients by ignoring the reporting 
provisions of the law* < ^'^ 

4» Law Enforcement : FBI and Immigration investigators ocqasionally check medi- 
cal records., Records workers report that: "They show their identification and sign 
the log. Usually they are just checking out someone's story. They want to know the ^ . 
dates we treated the person, what the ailment was, that sort of thing." 

For the last four years, the Los Angeles Police Department haa^had a liaispn 
officer work;;lng in the hospital records office. ''Before this time," Bliss recalls, 
"all divisions of LAPD were coming 'in here from everywhere and it got pretty hard to 
keep track of. So when LAPP suggested filtering all requests through an officer per- 
manently stationed here, it solved a lot of problem^. The officer interviews patients 
who are victims of crime- with their permission - and interrogates prisoners in the 
Jail ward. He handles information requests from JAfD officers, most of them over the 
^one." A Sergeant on duty said, "Sometimes we need to locate a victim who has already 
been released. We can check to see what address he or- she was discharged to* We also^ 
get missing persons cases... We can check the daily admissions repdrt for a psychiatric 
admission, maybe. Then we call the ward to check the identification further » What ad- 
ditional information we get depends on ward personnel,. I don't actue^lly let anyone 
handle' the record". Even if another officer did come in, he couldn't just sit and 
browse. Where mental health is involved, I can look at the record, but I couldn't »uae 
anything from.it except for locaibing^ a person* Sometdj^ we can pull good identifying 
information like Social Security number 'or Military I^T*' • . 

Patient authorization for release of Jjof ormation is not required by law or by 
the hospit^ for public reporting f*eqairemeiits or for insfrection by law enfo*rcement 
officers. . . * " 

5* Civiy Suits : Once a patient has filed a disability suit, a malpractice suit, 
^r a suit for Jamais resulting from an accident, his medical file may be open'not only 
to his own lawyers bu^ to the opposing party as well* When the patient's record is sub- 
poanaed, the whole record is usually copied and sent to the clerk of the court: there 
j,t is kept "closed" until the judge determines that it is relevant to the case. It is, 
however, put into the file of the case, and that is open ^or anyone involved with the «^ 
case to see. ' * ^ 

A lawyer in the Public Defender's Office comments that "Should you need medical 
information to help you impeach a vritness, you may be able to get good leads <from the / 
patient's physician. He may be reluctant to talk about the case, but most physicians 
dislike. taking^ a day off to go to court and^stify/ So you can threaten to subpoena 
/him, and he'll tell you^ enough to get you^tarted," 

6. Public Inquiries : Those who en^Euire 4bout a patient at the hospital are 
given only a' l^rief "condition report", in addition to the fact that the person is a 
» patient at the facility. Hospital rule's forbid staff members to release more informal ^ 
tion about a patient. According l;o Bliss, "Very few public figures come here, so Mp 
don't often have a problem of keeping reporters away."" The hospital does treat pa- 
tients who have been involved with the police, however, a '§0-bed jail wat*d is^part of 
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General Hospital. "These patients are in the custody of the Sheriff •s Office," said 
Bliss, "so we turn enquiries over to them. At one time we had the brother of Sirhan 
Sirhan here* There were many inquiries about his specific condition^ and he was in the 
psychiatric unit so the matter was even more sensitive. We just left it up to the 
Sheriff what he wanted to release/* - 

After the patient ieaves the Medical Cen-ier', his or her record is se^t to the ^ 
Medical Records Room at General Hospital, where it will be stored for apprclclmately 
five years. After this time, records are sent for ten yeara into p^rmanenf warehouse 
storage in the County Archives, ' t ^ 

Confidentiality of Patient RecordqjWlthin "the Hospital | 

The preceeding discussion described the broad dissemination of patient informa- 
tion that is made to outside, non-medlcal agencies, either without the patient's knowl- 
edge and consent, or with a pro forma consent to which the patient must agree in-order 
to receive medical treatment. Part t)f this pattern stems, as previously noted, from 
the lack of -financial resources which compels the hospital to focus on the patient's 
fin^dal eligibility. Part of it stems from the perception of the patient by the 
staff as a passive recipient of medical treatment,- a person unable to understand the 
treatment, unable to contl*ibute his own reactions, uninterested in his own^ record, and 
therefore imconcern^d about its confidentiality. These staff perceptions also dictate 
the way in which medical^ records are shared within the hospital. 

Members of the nursing staffs believe -„that patients ar'eTnot good sources of in- 
formation about their own medical problems. "'Sometimes^ there is a language barrier • 
But even where there isn't, the patient may have been told sp little about his condi- 
tion during past visits that he cannot of^er reliable information, "Half the time our 
patlehts don^t even know why they are here," said one nu^e\ "They are of ten* very con- 
fused and upfiet^by the whole experience. Only rar^J^y are they concerned about what you, 
are writing down in the re-cords." » * ^ • . 

The practice of collecting a broad range of financial information for ellglbll-' 
Ity, the searching interviews with' the Financial Service workers |v^and t^e storing of 
, the patient's chart in an accessible place at the ward nutBlm^iiloXi,^ Sive not seefl by 
the staff as creating patient resentment over violations l| confli?dentlallty; ' 

Patient data in the Admissions system are available in nijfe hospitals via al- 
most 120 terminals. Health Informations System Chief Gene Ihom^^. brieves that secu- 
rity of this ^material comes from the fact that "moat people^ don.'^3ipw"*vhat.4ata to in* 
t'he system.,, We could have sensitive psychiatric data In ttfre Inmost termina;i"us^^ 
wouldn't know how to get it out if they were asked." 3,Oo6%ar^^c t^^ea 'are ^iven- 
extra protection by limi-^ing their dissemination to the two teimnals in t^ EKG unit. 
Thompson adds that early in the development of ycomputer applications for County hospi- 
tals , the decision Was made the^t control over release, of information and re^onslblllty 
for its protection would remain in the hands of \he Medical Records Departm^t, the 
same unit ^hich controls release of the manual records described above. 

Medical Records Director Bliss states that if you "really wanted data out of ' 
that (computer) system and you could convince a clerk ^to do it, there's nothin^'o?to - 
stop that'. There's no such thing ^as a perfect system," '\ 
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Neither Medical Services Administrator pr. Sol Bernstein Jjor hi© counterpart on 
the administrative side, John McClurg, could remember many complaints involving confi- 
dentiality of the hospit^*s records. Bernstein said, "I do remember one case where a 
person wrote in to complain. She had transsexual surgery performed and at some later 
time had seen A copy of her medical record. In it, she found herself described as "iie" 
in quotation marks. ^S'he found this offensive and wanted the slurs removed*" 

Bernstein went on t«> observe: "Most of our patients are not as sophisticated as 
, patients in private hospitals, so they don't raise complaints often.^ In a Straining in- 
stitution like this — particularly a public one — the re^cord fs a very open one. We*d 
like it to be otherwise. Even oiir staff members raise this issue. *A short time ago, 
interns and student nurses raised the issue with respect to their own medical records." 
Some of them receive treatment' at county medical or psychiatric facilities, including 
the Medical Center,* and they worry about who ^mong their colleagues might ^ain easy, 
albeit unauthorized, access to the records. 

Local American Civil Liberties Union chapters and political groups in Los 
^geles Report few complaints on confidentiality issues in medical records. Speaking 
generally about the problems which low income patients face in California, Kenneth Win$ 
of the Nationa]^ Health .Law Center at UCLA said "The right to keep your medical records^ 
confidential is an obscure legal right, almost totally unenforceable. The' institution 
' knows that the patient won't sue because of it. Also, it's a. luxury issue that no 
legal-services agency will handle^ when legal resources are limited." He did report 
that "some cases involving confidentiality have come here. For example, one patient 
felt .that there were inaccuracies fin her psychiatric record. She couldn't get to the 
recor4s, which were' in a stat^ facility. And God knows who had access to' the i^orma- 
tidn. She thought there was mis-&iagnosis about ten years ago and it came uf in some 
employment process. But we sai(i, giyen our- limited resources, we couldn't pursue 
this." 

Patient Access ' / * ^ . f« » 

Under California law, the, patient 'has no guaranteed right, to see his or her medi- 
cal record personally. ^ Howe-wer, the patient cm autliorize an attorney to see the re- 
cord, and some hospitals have extended this to include showing patients their record 
whenever tiiey say they are contemplating litigation. Los Angeles County does not do 
this. As tp malpractice, doctors are adjured to take paihs- to get the necessary con- 
seht forms for surgical and other procedures (which presumably are nof covered by the 
general coi^ent form signed by the patient upon admission) and in getting such "in - . 
formed coii^ent" the patient must be told something about the upcoming surgery. Of 
Gouiiee, getting informed consent here is for the protection of ^ the doctor, not for the 
informati6n of the patient. " ^ f 

In the normal course of a hospital- stay , the patient is told little about his 
j*^'cord. The following staff comments speak for themselves: A nursing supervisor: 
"Sometimes the patient wants to see the chart when they've been kept virtually incom- 
municado for some time. The patient may want to know how the X-rays came out "because 
nobody told himJ Or the^atient pay just want to know what's happening to him and 
what^s going to be done."' , 
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^ The Nursing Services Mminietra tor : "If they've had an argument with tjieir doc- 
tor, 'or they've gotten upse«|nd thrown something at a nurs^, they want to see what's 
been written about them, 'They don't want to be written up as a troublemaker. Some- 
timei3 it's more of a medical matter that .they want to control, like whether the doc- 
tor describes their problems as "ai^cohol related," * • - 

Because patients are billed at a flat daily rate, and the bills are not item- 
ized, patients s^etimes go to the Medical Records Department for an explanation. 
Assistant Medical Records Director Faulkner says that occasionally the Records staff 
will sit down with a patient and go over the things that the bill covers "if we think 
it will Jjl^p," ^. » • ^ ^ 

The staff does not recall ever having been sued over a patient access issue, 
and receives very few co'mplaints about it* Dr, Bernstein comments^ "As a matter of 
hospital policy, the patient ought to know as much as possible about his condition. 
The pati^t moves from place, to place for care, and his records don't always catch up 
with him. But it's hard to keep a patient informed in a public hospital setting like 
ours. And I'm not, sure that just giving the patient his- record is the answer," 

Informed Consent 

The issue of informed consent was raised quite sharply in 1974 vhen a group of 
Chicano and Black women sued the Medical Center, claiming that they had been sterilized 
without knowledgeable consent. One of the women noted that she had worn an lUD device ^ 
for 'two years, not realizing that she had been sterilized in the course of a,Aa|sarian 
delivery. The women sought damages, aM asked the court t^ force the hospital^nto 
compliance with new regulations oh consents for sterilization. 

Under court and community pressure, the hospital has increased its e'f forts to 
comply with HEW rules, A new consent form, in Spanish as well as English, was adopted 
which -explains the procedures and their consequences in language at the 6th grade level. 
In addition, a 72 hour waiting period! ia-'^served, where possible,, between consent and 
the operation. Civil liberties lawyeimwho work on such problems (including the law- 
yers for this case) generally agree thkt the HEW regulations are adequate. The pro- 
blem, they say, is that most hospitaa;s operate in such a way that it is very difficult 
to enforce themT Bliss noted that/the suit has had the effect of making the hospital 
stafX more cautious in sterilization cases, "There's more staff consultation and we've 
tried to increase supervision and/ counselling so that no one signs a consent when they 
are not in a position to think aliout it clearly," Recently, there has been some dis- 
cussion of preparing a consent form in still simpler language — perhaps at the 3rd grade 
level, ' / . - \ 
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Los Angeles County's Medical Center shAw^ what happens to citizen rights when 
computerization unfolds in a setting of misdical efforts to provide acute care under 
ghetto conditions. The pressure to recover costs from as many people as possible is 
the underlying reason for denjanding extensive disclosure from patients, and this forced 
computer efforts toward fiscal applications rather tijan the emphasis on patieit -care 
that the data bank project ojriginally hoped to maintain. Providing patient dignity — 
of which rights of privacy Infoiied^con^ confidentiality, and individual access 
are prime* components — is a casualty to the rush of hospital personnel to handle the 
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idaily pressures — drug overdoses, acute alcohtftlsm, baby batterixigs, lead poisoning, 
and all the other medical stigmata of life in East Lost Angeles. 

Of course, tfiere are difficult issues here; the civil liberties values do have 
to be weighed against needs of law enforcement, monitoring health care eligibilities, . 
protecting public health, etc. But at Los Angeles County Medical Center, today , there 
is so little balance -at work; notone within the Center s.i*rff or outside groups are 
there to put the civil liberties values into the other scale, and calL for sensitive 
judgments to be made. ^ ' 

If American society were to decide that Rights of * informed consent, confiden- 
tiality and patient access were to be defined ank protected, making these meaningful 
at urban hospitals such a^ Los Angeles County would require both fS^nancial and person- 
nel resources. New consent and confid^entiality rules and procedures^ would have to be 
posted and explained, ^and^ t^eir observance policed by patients* rights advocates or 
ombudsmen. Enlarging patient access would take a mad or recasting of medical-record no- 
tations into language intelligible to the lay person, a process strongly advocated by 
"consumer oriented" medical ^erts such as Dr. Lawrence Weed, who see such disclosure 
as a vital part of patient participation in the health-seeking process. Staff time 
woUld also have to be provided to hold conferences with Los Angeles* patients to ex- 
plain the record, and to answer questions. This type of patient-hospital relationship 
has thus far been limited to a few elite institutions, usually with middle -and upper 
class patients ^ and even fewer .community health centers treating the^poor. 

Some progress toward such pracliices may well be mandated by law. A bill to cre- 
ate a California Fair Information Practices Act, introduced in 1974, would regulate the 
use and transfer of all personal data in the personal data systems of government agen- 
cies, whether state, county, or municipal. This would include medical records, and 
would strengthen both confidentiality rules. and patient access rights in public insti-^ 
tutions. ' The bill was passed in 1975 but was vetoed at the last minute by Governor 
Edmund Browj^^ Jr. , in par\ because of the expense he said it would cost government / 
&^6ncies to comply. The~'bill was reintroduced in 1976 and has excellent chances of re-, 
passage. ?ive states — Massachusetts, Arizona, Minnesota, Utah, and New Hampshire^ — 
have already passed such acts in the past 2 years. 

The effects of such new laws in urban hospitals have yet to be felt. It may be 
some time before regulations implementing them are issued and followed, and before pa- 
tients begin to-J.earn what rights they have and to exercise them. But the seeds of 
change are In such new laws, and their effects at institutions like the Los Angles 
County Hospital System may well be enormous in the coming years. 
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CHAPTER 6. MARTIN LUTHER KING JR. HEALTH 9ENTBR 

The Dr. Martin Luther King Jr. Health Center is a ffederally- funded, pisivate 
facility providing ambulatory care in a poverty area of the South Bronx (New York City). 
Associated with Montefiore Hospital, it supplies comprehensive, continuous,, and family-' 
centered health care to approximately 40,000 registered patients, out of an area popu- 
lation of 90,000. A staff of 450 offers in-patient medical services, preventive care 
activities, chronic disease treatment, and a wide range of socio-medickl pfograms. ' 

The Center is as much a social insitution as a medical facility^, and has been 
described by observers .and residents alike as the most active, important, and communi- 
ty-accepted organization .in the area. Patients' rights are a foremoBt conceroA- as 
a matter of Center philosophy, rules', training, and daily procedures;^ Purthemore, the 
adoption of computer technology at the Center has bpen.carried out in the context 'of 
very different goals and management "styles" than in los Angeles: a stress oh the 
health- team rather than medical-professional model of care; major community inputs 
into Center priorities and decisions; and an insistence that "machines" must facili- 
tate rather than weaken the Center's basic commitment to patient dignity and social 
advocacy . ' 

Background 

The formation of the King Center came from two interconnected developments in 
the middle 1960's; (l) the interest of ^he federal Office of Economise Opportunity (OEO) 
in funding demonstration projects for comprehensive health^c^^in low-income-neighbor- 
hoods, and (2) the desire of Dr. George Silver, Chfef pf's^ial Medicine at Montefiore 
Hospital, to develop an <Sut-patient group practice for the area's overcrowded hospital 
clinics and emergency room facilities. Silver was also influenced by a consumer- 
controlled clinic in Saskatchewan*, Canada, and he saw some f^ of local-community 
participation as an important ingredient ±n his plan. ' ' \ 

The area in which the King Center merged was (and stiL is) an urban disaster 
zone. A 45-block section of the South Bronx, it was once a loweJ^^sij^le class Jewish 
community. But by the 1960^^ h^d become a poverty area with 4-5?^ Afro-Americans, 
47^ Latin- Americans, and 6'A whites. I<ts statistical characteristics represent a litany 
of social blight: 50^ unemployment; highest arson rates in the nation; 20^ of the 
buildings abandoned; one of _^ the* highest narcotics death rates in the city; high inci- 
dence of tuberculosis, VD, alcoholism "and lead poisoning; widespread rat and vermih 
infestation; and substandard schools, police, sanitation, transportation, and welfare 
services. There are four public housing developments in the firea; while their physi- 
cal layout is less dismal than the surrounding blocks, local ^community leaders "Ijall 
them "a high-rise, concrete ghetto," and these residents face' a serious crime problem 
daily. " • . ' . 

The Center opened in 1967, funded by a $1.9 million grant from OEO given to 
Montefiore Hospital, as the Center's sponsoring organization. In its first year fit 
^upplied care to J, 400 registered families. OEO's guidelines for the Centet Mfire cast 
in the war-on-poverty framework of that period: ° "a-oommitment to the concept of re- 
distributing power within a community siting ; . 
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....and a restoration of the citizen*s significance within a' coxnmimity . " The .Center 
spent six years und^ OEO/Begis , expanding its services steadily. This etided in 1973, 
and the Center's f^er^support (now about half of an annual budget slightly over 
S8 million) has come since then fr6m a grant by the Bureau of Community Health Services 
in the Health Services Administration of HEW. The other half of the Ce^er's budget 
comes from Medicaid and other third-party payers. In ^1972, the ''Center had over 200,000 
patient visits, and its Family Health Wprkers made over 40,000 home visits. 

The"" Center's concept of medical 6ftre.and social"*^dvocacy rests on five 
approaches: ^ . • 

1 .^''^^fi^aching Out into the Community » 

The^ Center's philosophy is based' on the concept of community outreach. It does 
not wait for a patient to come, to it with particular ailments, then 'treat just those. 
Rather, its goal is to practice preventive medicixife by registering families and treat- 
ing them on a continuing basis, starting with a general check-up. Beyond that, it 
seeks to identify serious community health problems, and attack them ^ in a unified way 
through individual care, research, education^ and social action. 

Of the 90,000 people in the Center's current geographical area, 39,000 in ap- 
pr9xima^ely 9,400 families are registered as pajtients. This -was originally achieved 
by the stuffing of nailboxes ai t t » - ^ af lets about the Center and attending' community 
meetings. Because the community has S*h^ popu^ion iurnover, continuing registra- 
tion campaigns are needed. 

Non-registered patients do not get total team care, but they 'are given emergency 
care and occasionally specialized care. As registration of families increases, emer- 
gency room use decreases. It presently stands at about 25^ of patient visits, down 
from between 35-40;^ during the Center's first year. 

The hope of the Center's founders was that every individual Regardless of in- 
come would be eligible for care at the Center'. But in 1 971 , simultaneously with a re-- 
duction in the amount of the OEO grant, OEO issued a regulation requiring a means test' 
and setting a fee schedule for those ineligible for government "aid. The ruling brought 
an angry reaction from MI?'s then Director, Drt William Lloyd. ^ ' ^: 

4.U ^^^^ to" bet# inflicted on our patients is of far greater magnitude than 

the blow to the Center's goal of serving the community with comprehensive care. The 
retired civU servant with heart disease cannot afford good amhul^toi^y care here or 
elsewhere. ..The children of a marginally employed worker will no longer be screened . 
for lead poisoning. . .We believe that the best guarantee that a singly, standard of 
health care applies to all is to treat. all, without economic distinction* in 4he same 
program." . ■ ^ * Vm-v ▼ - r 

As a result of the Ruling, the Center was foi*ce^ to limit rlgiptration -to: 
4) car^ of pregnant women and new mothers and babies; 2) patients eiigi>|.e for Medi- 
caid%- 3) ^patients eligible for. Medicare; and 4) shut-ins. ?ince 8C^^f the 'community 
is poor enough^to be eligible for Medicaid or Medicare, this meant .^fchat about 20^^ of . 
the people wer^ - and^are - cut off from registered care. In ^dditlon^ th^ registra- 
tion-forms had to be changed. to include questions about "income" and 'Welfare status" 

*whlcji had not be enc asked before. C',' ' • 

f 2. J Community ProgrfiQns , ^ ' v' ^ . 

J The Center believes tljat pursuing good health re quire s'bothSi^pat lent eSucation ^ 
and social action alongside patients where conditi'ons in the community threaten . * 
health. « ' • ^ ^ '\ ' " \ 

Among Ihe Center's special program3 have been:. * ^ 
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a) Lead Poisoning Prevention.^ The Center tested registered children from ages* 
1-6 who appeared to' have pne or more "su&icious" lead poisoning symptoms. It pin- 
pointed those apartment' h^U^^^with peelink paint l)r plaster,- and held meetings with 
parents to explain the dange^f^a and suggest ^prevention, and put families in touch with 
New York's Emergency Repair Sel^ices. ' > 

b) Drug Abuse and Alcoholism. The Center identifies addicts through check-ups 
and through home visits by the f&mily health workers. They are refeWed to various 
city arug programs and hospitals for detoxification. In Addition, ^e Center set up 
a store- front, walk- in center where residents m^y get educational materials on drugs, 
referrals and counselling^- A similar project in 'cooperation with community groups 
was undertaken for alcoholics. 

c) School Hearj|h Edijcation Projects, Four teams of three staff members con- 
ducted 45-minute daily heal tl^^ sessions with the 15 eighth grade classes of intermedi- 
ate School #148. The sessions covered sex education^ menstruation, human growth,\^^^^ 
nutrition, venereal disease, dental care, narcotics, alcoholism., family relations and' 
any other questions on the students' minds. 

d) Environment. "Providing comprehensive, medical care to some 39,000 people 
living in a low income area of the £outh Bronx... is simply a half measure since local 
environmental conditions are the source of many of the area's medical problems." This 
reasoning led the Center into active participation with other groups to improve hous- 
ing and" environment through seeking housing planning grants from the federal govern- 
ment,; negotiating with landlords for building maintenance, trash removal and rat con- 
trol; negoti'^ting with city officials to insure housing law enforcement; and finding 
private and public sponsors for new housing. 

e) Recreation. The -Center has sponsored a youth club as an alternative to 
street gangs; this gave instruction aild help in community projects, black and Puerto 
Rican culture, arts and crafts, health education, and career development. It sj^iisored 
a summer recreation program in which 125 teen-agers participated, 

^ These commiMity programs, and the training programs", have had' to be cut back 
or| eliminated because of cuts in federal funding in the 1971-76 period, but the Center 
, continues to pursue them as vigorously as funds allow. \ ' 

"3. Recruitment of Staff from the Community, and of *^ommitted" Medical Personnel 

To recruit its general staff, the Center stuffed local mailboxes with fliers • 
urging applications from residents and held more than 150 meetings with community organ- 
izations in churches, schools an d apartment houses to explain the Center and urge peo- 
ple to work there. The majority of the 450-mefflbeT^ staff, as a result, resides i^ th^ 
community and is 90^ black 'or Puerto Rican, closely approaching the community's compo- 
sition, now 62?^ black and 36$^ Puerto Rican^ . - 

The recruitment of doctors to^reflec.t the community's racial composition has 
not been as successful. Of the Center's 98 full and part-time doctors, only 9 are 
black or Puerto Rican in spite of the Center's vigorous attempts to enlist .them; how- 
evej;, many other foreign nationals serve on the medical staff; these include Indians, 
Pakesjfcanis, and other non-whites. The turnover of doctors has been high, with an 
iverake searvice of three years or less. The original vision of the Center 's^founders 
was al cadre ^ of' permanenf^ doctors dedicated to the family-oriented,, team practice of 
medicine, who would provide continuity and confidence to the patients. That goal 
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seemed practical during the 1960's when many students chose public service over * • 
professional advancement — teachers choosing ghetlio schools , ^ lawyers spurning corpo- 
rate practice for pro bono firms, doctors regarding assignment to ghetto health cire 
as an opportunitjf, not as consignment to "Siberia." Today, though, the Cente" has a 
preddminantly short-term, white medical staff. 

4. .Special Trai|iing in Center Philosophy and Techniques 

The .Ceater conducts training for its staff to insv&e promotion from within 
Wherever possible. At present, 26 of its 29 supervisors are community residents, many 
. ^of whom were previously unemployed and inexperienced; five of, its eight senior managers 
are jcommunity residents. Perhaps the most remarkable success .story is that &f Ms. 
_ . Deloris' Smith. Although she had no professional training, Ms. Smith had long been a- 
leader in community affairs -in the PTA, in organizing a .redit Union, as an officer 
of the Tenants' Associ^tijjn. She enlisted aa a Family Health Worker trainee at one of 
the Center's community recruitment meetings in 1967 because' "it was NoVember. . .and they 
were paying S55 a week to trainees so I figured that by the time Christmas came around 
I would have $250 saved and I could use the money to buy presents for my seven kids." 
I"Is. Smith rose' to become DepSiy^rectoi- and is now Director of the* Center, the first 
>non-M.D. to hold that post. . _ - 

During its firsf five years, the Center also conducted tWining for community 
residents so that they could get jobs elsewhere. Its training program no^is much 
_ smaller than it_was in 1967-1972, during which time it turned ou.t some 400 medical 
assistants, technicians, family health, workers , and medical clerical workers. -The 
shrinking job marke raid, the cut in the Center's budget have forced it to confine its 
training to those specW Center. projects where specific job skill's are requfred. - 
5. The Community Advisbry Board 

^ As with most OEO .programs one of the requirements for the Center was the crea- 
tion of a Board that would represent the commuhity. This was also the goal^f the Cen- 
ter' s founders -^%o have a Board not of wealthy or socially prominant patrons but of 
peopli from the same social class as the patients. . .The Center's Board is elected by 
21 delegates, who become delegates by collecting 25 supporting sil^tature« on a neigh- 
borhood petition. The 21 delegates elect tile'21 members of the Board," and are them- 
selves eligible to run for the Board. .Thus the delegates and/or Board members, while 
fulfillir^ the community-resident requirements, represent an electorate of less than 
600 individuals in a population of approximately 60,000 voting age adults. 

It is difficult to -assess t^e' part, actually played by the Community Advisory 
Board in setting Center policies or .in providing a community link, partly because ^ 
there is not a common understanding of the Board Is' role. The Center's staff and the 
.jguiion representing . the staff have feared Board intervention into management deci- 
Tffions, and there have been some confrontations over hiring and firing. The Comnlunity 
Board, on its side, has objected to being by-passed in the establi'shment, oil community 
programs. 

Under the original OEO-Center agreement, the Community Board was .meant to --be the 
recipient of the federal grant by ^'^l^rr^^I^^i^^^^o^^^^^or.X.t^,,^ Hospital ' 
When HEW r^placed^OEO as the grantor in 1973. tb« transfer ofThe grant to the Co^^. 
^ nity Board was delayed indefinitely, and for ^his the Coiaunity Board >lames not only " 
OEO and HEW, but the Center's" administration. 
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In spite 'of a history of conflict, the Center, and the Board have found a basic 
modus^ Vivendi, One can infer that the Center regards the Board as an important commu- 
nity link, although not the only one. The Board, although frustrated in its desire ' 
^to get the grant, funds and set policy, recognizes that the administration, as a Board 
spoke^sman said, is trying to deliver "the best services possible in the Health- Center," 

'Health Care At /The Martin Luther Kin^ Center 

. / The community ties developed "by the Center serve to bV^ak' down the "we- they" 
attitudes that have in the past characterized many programs for the •poor. When staff, 
hire,d from the community, work with community residents t(^ secure better housing, for 
instance, a spirit of partnership instead of paternsilism is fostered. That same spirit 
of partnership permeates the Center's practice of medicine • 
1 , Team Practice * 

Each registered family is assigned tl one of eight hesilth care teams* A typical 
,hea3>Wi care teto consists of six family health workers, i^wo public health nurses, one 
pediatrician, two internists, one dentist and one secretary, A pharmacist serves two 
to three hesilth teams. 

The family health worker (both men and women serve in tRese posts) provides the 
closest link to the patients. After six months' training,' these^ workers are able to 
keep records, perform certain medical duties, make referrals to other agencies, explain^ 
the Center's operations, assist with appointments, and generally nelp with the family's, 
cedical and social problems. Each fami^ly health worker serves about 225 families and 
tries to visit each one at least ^nce every three months as well as^ to register eligi^ 
ble new families as they move into the-neighborhood, • ' * 

A family health worker describes some of the things she does as follows: ^ 
"Mrs, A, has trouble seeing and counts on me tq help get her to the health cen-' 
ter for appointments. On the way home, I usually do some shopping for her,,, Mrs, B,' 
uses a walker and^I am arranging^ for her to get a wheel chair fio she can get around 
better,,,! helped make arrangements for Mrs, D's child to get ^nto the hospital since 
Mrs, D,'s English isn't too good,,. Mrs. E, says her 80 year old* mother needs privac^C^ 
and asked if I can help get an apartment with one more room. A ^een-age girl wants N 
an appointment to discuss birth control. She wants me to explain what the nurse will 
do and set up the appointment, 

"The internist asks me to check the blood pressure of a hypertensive patient,,. 
The pediatrician asks me to evaluate the possibility of child neglect. One of the 
children had been burned/fv^e "by hot liquid,.. The nurse asks me to bring penicillin 
to a patient who has no /phone , " ' 

The Center feels that the family health workey provides the needed sense of 
continuity for the families under her bare, and helps ameliorate the high turnover of 
doctors. ' 

The team's nurses are each resp9nsible fDr&59l750 .^>atients covered by three 
famiXy health workers. They i^t^'uct and *as^si'stthe family health worker in medica- 
tion and medical procedures, and after briefing IJy the doctors, "care ^or'many of the . 
patients on follow-up visits. 1?hey are responsible for medical chart; supervision, 
"During one recent day, J' reports a team nurse, "I interacted with family health Horke.rs 
18 times,,.! aommunicate with the team physicians several times throughout the day," 

Direct patient care. at the Center takes up the major portion of the day for the 
team physician, who* is responsible for about 2,400 patients, ^ A team pediatriaiari 
reports: ' _^ • ^ . 

"I have eight clinical sessions per w^fk, I see an average of seven to eight 
patients per se^ssibn. In a set-up like - this Center, one realizes that one-'s re- 
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sponsibility to the patient does not end with gust looking after th*" medical problem,,. 
I spend some of my time writing ibtter^ for better housing facilities and more finan- 
cial assistance; c(5ntacting the Bureau of Child Welfare in cases of neglected children 
talking with school guiaance bounselors; teaching mothers preventive- as well as acute 
medical care/^^These problems are not solved overnight, but I get a good feeling of 
satisfaction whenever we are able to help even just one or jierely scratch the surface 
» of another," 

In addition to informal conferences throughout the day, the team schedules a 
regular session at^which all members meet for one hour a week. 

The tes^timony from many team members perhaps "testimonials" would be more 
apt ^ show their strong commitment to teSfia practice. But the smooth functioning of 
the teams evolved slowly. In the beginning, family health workers resented their be- 
ing regarded by nurses and doctors as mere "messengers," Dqptors complained that ' 
^ nurses were "subservient'; ana avoiaea decision-maKing. Nurses, on the other nana, re- 
sented traditionally-trained doctors whose attitude was "I am the physician and I make 
the decisions," Doctors were criticized for "talking too much," &nd trying to domi- 
nate team meetings. It took years of conscious effort by. all team members to get. the 
teams to mesh smoothly and to emerge as tight-knit "family" groups. The extent to^ • 
which thai tiransformation has taken place is seen in the comments of a team int^rhist: 

"No one^ on the team is alone wit^ problems of any one patient and the sharing 
is comforting;,, After learning to eat chitlins with sangria, doing the Puerto Rican 
bolero with my white Ozark savoir-faire and ushering' at the wedding of a family health 
worker's daughter, ,, being a member on an lOT teacf begins moving from the pages of a 
^ treatise on social psychology to a vital, rewarding experience —and I find myself in 
a position that I really l:i.ke," 
2^ Medical Record Keeping 

Registration at the Center is by family. A Family Registration fon^ collects 
family and household identification information (names, address, tel'feplione number, 
weekly incomes of family members, insurance data, e.g. Medicaid number). Each redord 
is. assigned a five-digit family identification number, and each member is then given 
a two-digit prefix number, e.g.- head of household. This is an internal record-keep- 
ing device; the Social Security number is not used as a patient identifier as it is 
in some health care institutions, • • , ^ ^ 

Each patient within the family is then given his or her own individual re'cord 
which contains the results of regular check-ups: x-ray reports, laboratory summary 
sheet, ECG results, as well as a continuingf record 6f any additional medical cate, " * 
It also contains a No-Show record, which we will discuss shortly. 

Since 1970, the Center has been using the problen-oriented record (PCH) devel- 
oped by Dr, Lawrenoe Weed, who visited the Center in I9bb to explain hie oonee^is io 
the staff, , Instead of filing items chronologically in a medical record, with sumer- 
.-les written whenever a fresh complaint is mat, "the POR technique is based on develop- 
ment of a "patient profile" that includes both social history anil medical treatments; 
a problem list -that identifies the chief current problems and serves as an "issue- 
oriented" table of contents to the full record; an initial plan of management fpr 
each item on the problem list; and progress notes geared specifically to each item 
listed • |The Center started using the Weed system in 1970 with training sessions In 
its proper use; between a third^and a half of the charts are now kept in that form, 
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Computer Development 

In its first ^ew years, the Center did billings, payroll, and basic reports on 
a small computer^ using bjatch-processing. Several important research studies of commu- 
nity health needs and patient utilization of the Center were conducted through the aid 
of computer data analysis, as well as^a statistical audit of service delivery by pro- 
fessionals and staff teams, made possible "by disposition sheets produced^ by computer. 

In 1971 , the Center movQ^d to an on-line computer system. The picture 'of record 
keeping in the Center's Report for that year graphically explains why the administra- 
tion felt a need to tur)j more heavily to computers. It described proliferating paper 
for which there was no room; delayed or missing lab reports; duplicate appointments 
and mistaken appointments causing "at least half of the no-shows;" incorrect billing; 
unfiled records and laboratory reports; and government reports not forwarded by the ' 
required date3<^ 

With its 1 97 \ expansion, the Center not only worked on those problems but also 
developed a monthly "pr9file" on each patient who had a'^edical transaction the previous 
month, This profile was attached to the patient's folder and was designed for both 
admiriistrative and direct-care purposes. It served to upjiate billings, flag routine 
treatments due', print out a problem-oriented table of contents to facilitate chkrt 
review, reduce duplicate appointments', remind physicians about drug sensitivities, and 
"identify^afid fo^ru^ attention upon * overutilizers * and 'underutilizers. *" 

The computer was also used in 1971 to process the results of a door-to-door 
survey conducted by Center perso&iel to validate and update patient registrations, 
collect data to justify insurance payments for registered patients, and assign a pri- . 
ority based on medical need for the proc^^sing of new,- unregistered residents. 

The Center also expanded during 1971 its "management information system," (MIS) 
designed to provide the "timely and accurate" data ''to formulate decisions governing 
operations of the Heafl.th Center, such as staffing, scheduling, etc." This MIS work 
was based on a set dr weekly computer-generated tables reporting various activities 
(such as patient encounters) during the previous week, ^he tables allowed management 
to monitor individual and unit performance, and made possible better projections of 
monthly- and annual patient volumes, 

Computer development continued actively during 1 972 and the Center installed a 
larger, IBIA 360 system in early 1973. Today, it has major application systems for 
registrations, appointments, laboratory tests, billing, patient encounters, jj^yroll 
ahd personnel, quarterly reports, and integrated management information. Several of 
these -are worth noting for our profile, since they show how patient-care operations 
are affected by computer use , * * • ^ 

1 . Appbintjaent^ 

"Appointment Central, V a ^ faction of tha health services department, generates a 
master schedule 'of all appointm^-h^s and produces a weekly appointment sheet for each 
practitioner seven waek^ in advance gf scheduled dates. Appointment sheets from each 
heSalth-care unit are collected two days*prior to the sessipn and are checked against 
'^a preli^ainary printouts furnished by the comj)uter and last minu-^e appointments, such 
''as special follow-ups, are added. The ,sA^ets are sent to eacli health-care unit at the 
beginning of the month in whifcji the^ appointment is made,^ and the receptrbnist mails ^ 
notice to. the patient, , 
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"Appointment Central" plans to Jnstall as soon as possible an on-line appointment 
system listing all scheduled appointments for a patient (thereby avoiding^ dupli^cate 
appointments with a single practitioner and simultaneo'us appcxintments with two differ- 
ent practitioners) and dlso displaying on a terminal screen the available appointments 
for a practitioner at any given* session, . . . 
* 2 ♦ Laboratory System ~ *. • 

The "Lab Central" application has automated much of what used to be manual lab- 
oratory clerical work. Test results are first verified in the lab as having been c^- 
_ pleted and are th^n sent to "Lab Centrarl," where they ar.^. coded and processed in the 
keypunch and data processing divisions, "Stat" work is done and reported immediately, 
and physicians can now secure reports such as chemistries, urinalysis, and wet preps 
within a 24-houf periodT, where these once^took 2-3 days. Comparisons between ordered 
and completed lab work are still done substantially by hand, but a new system being 
installed will permit recording the receipt of a lab result, ^yen if the actual report 
must be forwarded physically to the medical records department for filing, ^ 
5, Billing System , - ' ^ 

The billing system takes encounter data, compares it against the master roster 
and produces a billing history file used to generate Medicaid and Medicare bills. 
Although the billing system has been sufficiently developed to bill Medicare and Medi- 
caid with reasonable accuracy, the Center still' has problems with inaccurate billinir 
on the master fjyie and missing billing infonnation relating to patients eligible for 
Medicare, and it is continuing to work on those problems, Itonual folloV-up^ after 
treatment is ^till u^ed to record the treatment, diagnosis, and name of the attending 
physician, sinW^/tTis often aifficult to obtain all of this at the time of treatment, ' 
when the patient encounter form is completed, ^ 
4* Reporting 

The Center is required to submit s-fatisficail utilization- reports at quarterly 
interv^a to the Department of Healthy Education, and Welfare, basically to "justify 
(the eenter»s) existence to the peo^e in Washington," The computer makes it possible 
to supply the data that HEW requires, such as the number of patiedts registered and 
receiving care within a given time ^period; the number of visits to each unit of the 
^ Center during thaf period; and the number of patients registered per physician or 
health care 
Research 

The Center »s administration has used its "data base of medical, demographic, and 
managem^ht information" to suppoirt a variety of research projects in recent years. 
Most have bTsen geared to impro-^ement of the Center's* medical and social programs. For 
Example, as part of the lead-poisoning campaign descrii)e4^ earlier, reports of lead- 
poisoning cases were fed into a confputer file of buildings and registered children to 
generate reports about children in danger of becoming pc«.son§d who had not yet been 
contacted or treated. Other studies h^ve involved produciiivity analysis and patient 
flows ±n the pediatrics department, as well as the incidence of various specific dis- 
eases and conditions, • ^ 

Overall, Center Director Deloris Smith believes that the computer has been a 
good tool. She says it has reduced the number of personnel needed in the medical re- 
cords and billings departments; "beefed up" financial anai^rsis and reporting? and pro- 
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vided the central administration with "useful information rather than a lot of useless 
print-out." • , 

Even more signif ictotly , though the ^op administrators and, the data processing 
staffs are thoroughly aware of the specific computer systems, the nurses, \fami^y health 
workers, and practitioners whom our project interviewed were not particularly aware of 
what patient data vere stored in the computer or how the various application systems 
worked. They simply took the computer-assUsted operations for granted, and had learned 
what they needed to^ in order to us^the BDP equipment. They felt no conflict between 
their missions and the on-going computer devel'opm^t 

This underscores a point made in the Center's Fourth Annual Report "( 1 971 ) by 
its then Director, Dr. Harold Wise. Once organizaiiions move to "Qomplicated technology. 
Dr. Wise noted, even in supposedly "consumer-contirolledj' organizations, "the real con- 
trol" usually "is taken over by the managers. .. the layman must depend on the expertise 
of those who. work with technology to make the decision." This was especially true in 
the^ health area, he noted, where the technology "is complicated, magical andNnysteri- 
ous, and the quality of service difficult to monitoj-," One does not feel this from 
observing the daily routine or 'talking to staff at Martin Luther King. There is no 
sense of roles having been reorganized around ** computer needs" but, rather, of 'the 
basic health-team approach ,and staff social-advocacy activities having been intelli- 
gently supported, by EDP capabilities. No-one visiting the Center would imagine that 
the systems analysts, rather than Deltris Smith and her colleagues, are in* charge ffere. 

Citizen Right? at the Kin/y Center • -^^ \ 

The conventional wisdom is that the poor are so beSet by the probl^s of econom- 
ic survival --unemployment, poor housing, undernourishment — that refinements like dig- 
nified treatment, including privacy, are unimportant or at least secondary considera- 
tions. This conception of economic priorities is an arguable one. To site several - 
noted instances that run counter to this juagment, and involve Dr. King's own campaigns, 
we need only recall that the Montgomery, ACLabama bus boyc9tt of 1956 did not begin be- 
cause the poor blacks of Montgomery were seeking lower bus faizes. They were protesting 
'the indignity of l^^ng^ ferrced to sit '"in the back of the bus. Similarly, while Dr. 
King's campaign in f963 against segregation in Birmingham was directed partly against 
job discrimination, the issue that struck the deepest chord in the local black commu- 
nity, and became the focus of national demonstrations leading up to passage of Ihe 
federal civil rights act of 1964, was also a "dignity issue" — the refus'al of wJite 
merchantj^ to serve blacks at lunch counters and other public accommodation f^ollitiee. 

The Center *s Health Advocate (a pQSition create^J to represent and protect 
patients' interests) put it. this way s-* "Traditionally , health facilities are not inter- 
ested in dealing withy the rights or feelings of the patients. At MLK, we feel that 

emoJ;ional needs and desires 'of a patient is as much an integral 
part of the. treatment plan as'the actual prescribing of medicine." 

While i±^^^e% that^hese were i^ objectives, it took the Center about a year 
to formulate what patients^ rights meant in practice, since, there were, no ready model^ 
to copy^from other health 'centers , or in the health literature, or in legal procedures. 
A survey was conducted among* patients , staff, and administration to find out "what 
patients' rights meant to each of them" and what, should be formally declared .by the 
Center, This led to the, writing of a clear and cleverly illustrated booklet, "Your 
Rights as a Patient," done in both English and Spanish. At the same time, the Center 
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adopted a formal grievance procedure for patients and made the Health Advocate a repre- 
sentative of the patient, who was to follow all "grievances to insure their proper 
hajDBlling. , ' ^ . . • . 

The rights set out in the booklet are: (1) the right to courtesy and respect, 
(2) the right to refuse treatment^ (3) the right to a clear explanation of procedures 
and treatment, (4) the right to privacy, (5) the right to ahoose a convenient time for 
appointments, (6) the right to transportation to and from the Center when disable<l^ ' 
(7) the right to assista^e in applyiiig for Medicaid, and (8) the right to informed 
consen-t with respect to the exchange of information between the Center and other 
agencies (e.g., schools and re?^rals). 

, How several of these rights are explained to patients deserves reproduction 
here from the boolcle*J: 
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RIGHTS IN THE TREATMENT ROOM 



a) The patient has a right to consent to, or refuse any 
treatment , y 




b) 
c) 



The. patient has-a right to have things explained clearly* 
(F6r exsmp!^e, any'possible side effects^of medicines.) ■ 

The patient has the right to refu^ja treatment by any phy- 
sician and to request, a different doctor. 
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PRIVACY 



a) No employee should talk to you about your problems in 
the waiting room or halls or where others may hear, * 

> 



\ 




c)- You have a right^o consent to* 'any visit to your home. 
If at^all possible you should know in advance when the 
visit will take place. 




d) You have a right to refuse to participate in or be inter- 
viewed for researcja purposes. You have the. right to full 
explanation of puirposes and uses of the information if you 
do participate. 



r 
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CONFIDENTIALITY 



a) The patient has a right to have all information 

about ,hiin held in strict confidence by Health Center 
staff. 




b) The patient has a right- to see letters, know about 
conferences abottt him and results of conferences, 
^ (Patients mulst sign all letters.) 
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The booklet concludes with an explanation of the complaint procedures, aifd con- 
tains a complaint form which can be detached and mailed in to' the Community Health 
Advocacy Department. . ^ . 

The Center's booklet, it believes, was the first such publication for patients 
in the country. Since t^n,' it has been- widely cojJied by community health centers, 
though not by many government hospitals.,or. private health centers. 



According to the Health Advocate, Liery Wynn, "the Patients* Rights pamphlet led 
to changes in the system of .health car^ delivery." The way in which the rights it iden 
tified have been further defined and treated in practice, and how conflicts between 
Center positions and outside pressures have been handled, were a primary focus of our* 
visit to the King Center, and produced the following detailed portrait. 
1 . Right to information 

The Center's pamphlet tells patients "You have a right" to know what is going on. 
Always ask questions about anything that you do no€ understand or that is worrying you. 
Probably the most usual mechanism for enforcing this right is the close bond between 
the Family Health Worker and the patients; the health workers are. often not only ex- 
plaining terms and procedures but also telling the' doctors and nurses that the patient 
is uneasy or -wants fur.ther explaination , and seeing that this is provided. » 

Two examples of such practice came in interviews with Family Health Workers that 
have been published by the Center. The first v/as with a Mrs. Montgomery: • 

^ "I know I used to go to Morrisania Hospital before the King Center opened. 
And the doctor would come into the room and I knew when I told him I had a headache, 
he was going to give me an aspirin for that headache, and in two seconds he had gon^ 
to another patient. They really don't give you any time ta question or they .look at 
you like you are a specimen, as if to s&y, 'You don't talk back to me. I just tell 
what's going tp happen to you and that's it*' And they just walk away. Sometimes 
even if you ask them a question, you don't get any answer.' Or i# you get an answer 
they brush it right off, and that sort of turns you off KLght there. Ahd I think 
that is where the King Center is unique, because you can talk to most of 4;he doctors 
here*. If a patient has a problem speaking to a doctor, he'll come to a family health 
worker and tell her, -'Look', I asked him, but I didn't get the right answer.' And then 
we, in turn, would go back to the doctor and we would speak^ to the doctor and tell him. 
'This patient does not understand what is happening.. Will you explain it to her?' And 
most of the time the doctors will. I think that's one way that we are very good." 

Another health worker, Mrs. Lamot, d'escribed her experiences this way: 

"One of the things that has helped us encourage patients to do this is that 
paiaphlet that we have on patients' rights. I explain to the patients that if they go 
to aee a doctor etnd they ask questions and get an answer that, they are not satisfied 
with, or if they aiie not being treated properly, they have the right to go to the family 
health Worker 6r the person, in charge of the patients' rights and complain. When we 
ar.e on 6ur home visits we counsel the patient; we tell them to just come out gtnd talk 
to the doctor -aind don't be afraid because we constantly remind them that they have 
rights as patients. You know in other clinics the patients are afraid to speak up. 
But they are not here because we enforce the rul4» and we teach them how to ask ques- 
tions. They" know that they can depend on family/health work*ers whicb is good l)ecause 

want them to know that they have rights so there is a godd understanding between 
the patients and the Center staff. ^ 

How Mrs. Lamot does this was the subject of the foll!i^ing exchanges: 

Interviewer: ^ 
' l/f^ say for example* that a patient comes in with diabetes, and 
he has been put on a special diet and has to take certain piUs. H^ 
knows that he has to do these thin^ but he is not exactly sure 
why, Ilow would you encourage hint to get information aboul the 
trejtment'^ How would you get him to speal^ not only to you but 
' ' to ask the doctor*^ How would you encourage hinj to ask questions? 



.Mrs. Montgomerj;: ^ 

If a patient carne-40^ me and said, "I found out that I am a 
diabetic, and I know ! Tnrve-.4o be * on a special diet and ta^e 
special medication," I would cxpIam^Oothe patient as well as I 
could about his diet and medication. If hc^lr-stiUnot fully satisfied, 
then I would takT the patient back to^ the doctorTT^ieLihrec of us 
*/would sit down aVid the doctor would go over the whbte^ujine 
with Uie patient: iet him know just what he has to tpke. In th^ 
way I would get the same infonnation from the doctor as the 
patient, so then I couIlI reinforce tliv information the doctor told 
lum. 

Interviewer: 

Mow would you actually go about getting thc_ patient to ask the 
doctor Uie right questions so that in ilie future, when you are not 
around, he would k'now the right questions to ask'' How do vou 
teach the patient not to accept pills without knowing what iheyte 
really for*^ 

Mrs. Montgomery: ^ 

1 think that would really be patient education. NVlicn you go to 
the family you have to say to them, '*Look don't accept everything 
that anybody gives you. Question that. You have a right to qi-es- 
tion It. Wlienever you go to get medications or diets or anything 
feel free to ask that doctor whit's happening with you." I think 
It's up to the doctor too. if a patient can go tQ- a doctor knowing 
that' he can ask Imn really anything very simple and the doctor 
answers that patient nicely, I am quite sure that whpn the patient 
really has questions he will not be afraid to ask the doctor. Patients 
follow directions a lot better when they understand what is behind 
them. , ^ ^ ^ 

Interviewer: 

Do you think that thers is some set of questions that you c<in 
teach patients so that they know that when they have a meeting or 
an appgintment with the doctor there sliouid be certain questions 
they should always ask-there is certain information that they should ♦* 
walk out of that office knowing'' \ 
Mrs. Montgomery: 

Yes If. for example^ a doctor .is going to change a patient's 
medication or even if it's an old medication, the patient should 
speak to the doctor and ask him, "What's going to happen if I take 
this' pill? Am I going to. have a side effect'' Am I going to break 
oul in a sbglit rasli? WiU'l have a headache''" And I think patients 
sliould be aware of the questions that they can ask. 
Interviewer; 

Have you ^gotten any specific comments from patients about 
family health workers and how the. situation in this community has 
changed'' 
Mrs. Lamot: . 

I think wc have been Agoing through three stages. The first stage ^ 
was kind of friglUening because we were trying to feel our way in 
the cominunity-trying to sell the Center and our services to the 
community. In the second stage we learned \\6\v to get a lot 'of 
things done apd people gained con'fidenf^ in us. We did many 
things i^ior^teur pt^nts. We helped them with many problems. Wc 
were doing so much I think we made thVni dependent on us. You 
know, we were runnmg .to welfare, to thd hospital and so forth, 
and they lodked forward to those things. Vow, m the third stage, 1 
think we have to learn t*4 tpach then/ how to help themselves, 
because that is part of our jb^--I©-«Sch throiigli patient education. 
It IS kind of hard for ,thym to accept this because they have 
depended on us for so lon^. 
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Patients^ are told that they have a right to be informed about their records. In 

1/ Harold Wise, the Director, eraw a fall right of access to the record, as an 

i4poi'faLnt element on the Center's "consumer protection" goals. 

"In an effort to fully inform patients who wish to learn about iheir health 
s-tiatus, the medical record should' be made available to the p^^tient. Those patients 
^ who* wish should write » progress note^ in the chart. Such, a change in tradition 
would require considerable discussion with health workers who are trained to use 
wgrds like 'mitotic* for cancer and *lues' for syphilis, and* whose usual attempts 
at communication confound the average patient. The idea is that health workers should 
spell out to patients the alternatives of any bealtli treatment plan, encouraging the, 
patient to maie his own decision &s to choice of alternatives," 

Such record reviews do not seem to haye developed, except as part of the use 
of the Weed pr^oblem-oriented record^ with it«/(discussion with the patient of his/her 
chief complaints, treatment plan, and progress notes. * 

Liery Wynn, the He^th Advdcata reports that ^he has heard of only a few re- 
quests by patients to inspect their records\ "The record would not be , much use to the 
patient, anyway," he obseryed, "He probably wouldn't be ^ble to read, or understand 
muuh of the material in it*" However, a patient is shown the record if he or^'she in- 
sists. " * " • ^ 
2. Privacy ^/^ ^ ' ' « 

The Cen1>er treats privacy in terms of respect for the individual's dignity — 
not eipoii^ his or her medical situation to those staf^. members who do not need to 
toow iti 02^ ^to other residents who may be around 'the Center when the patient is there. 
This is expressed in the guide for medical assistajits„ used ,at the Center, which__con-r. 



tajjns ins tructiTDns. such as the^e: 

"'The patieht-tpractit|oner relationship is, a private on^, and nothing that is 
s^id in 'the office, is to be repeated. Another method of insuring thi^ privacy is to 
w res|)0ct*,the plosed-door policy* The only, way to communicate when a 'patient is in the 
office is by telephone, and thj-i^is to be*"u.^ed onjLy.when absolutely necessary. 

.4 '^Wheii the patierft^is to be examined, the assistant should instruct him about 

. ' d-resis preparation. When the patient is properly stripped and on the examination table, 
^ tjheimedical as^i^tant should cover his body loosely" wi'th a sheet, if necessary, to 
^insure privacy.." ^ 

^ ^ ' ' ^' ' 
u " • :Hpweyer, if 'one us^s the term privacy a^.we have generally dj^ne in" this study 

.^io r0f^T^ tf Jihe^ right not to *hav^e someone collect irrelevant or highly sens^itive per- 

• *'so|iap. data ^bo^ut ah individual — theh this s^imply does not arise as a consideration 

at'tak King^'fitnteijjl Ifciplioit.in the ideas of t^^am medicine and comprehensive care is 

llity' to/colleci^ as^MucE^non-medical data about the family as possible to help. 

reat' the "dociai problems'^Q^ the patiejitSf»al9ng with their *medical prroblems. ,AIJi data 

is ^4@ard,ed as relevant. It' will be-'^r^cailed ^ that -when Dr. Lloyd objected to the 

setting qf a means te^t^by'oBO itx 4id' so not on grounds that it would require 

the, patient .to *reye^' information about his/her i^ncome. b'uV only on the grounds that 

*it wdul^ deny care^td 4>90]jre, who.*need|d -it.l * « » / ' ^ 

3. (^nfide^allty: _y\thiti,^the CentW / 



^ I Family healti^^ WQrk^rs receive four hours of lnstruci?i.on on .patients^ r 
**tHe5tettol«ing progVaihs,- as well a4 a discussion "Ethics, and Conduct" thAt 



eights^ in 
speci- 

ficalj^^ciades "Confidentiality bf records, medical infor{nation;, patient, information," 
. ^ ' AihiB is considered vital because teaiti fiiedlcine^ at ^ the Center i^eans that infOrma- 
tion elsew^rfe reBtri^<^ted::ta the patient»?.s djo ct or ' or^ nurse is' shared with the entire' 
"^-'^ team, Including the •noliTmedi'cal, fam'^y health risers Ij;i recognition of the speodal;, 

problems created by thl^^roadene^d disS'epl^'^pn^ of infprmatiojji^, the Center has adopted 
, ' the -followijig r,ules '^o ;guaidv patient ^coAfidentiail \* ' . - 
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A» Breach of ponfideutiality constitutes just cause for automatic dismissal. 
According to Health Advocate Wynn, every employee at the Center. is well aware of this. 
In one case, an employee was dismissed for telling another about something* he had read 
in a patient • s chart • , ' ' " 

B. The teams have adopted the rule that. the confidentiality of patient infor- 
mation excha^ed'in team meei;ings must be respected. The family health worker, to ^ 
whom much sensitive information i^, revealed, doe^^^jiot write down the substance^of con- 
fidential communications on the record. Instead, he or she *puts a "see me" note to " 
the physician in the patient* s file. 

C. The presence of non-team mdmbe'^& at weekly team meetings is carefully 

screened^ Noj? members may_attend -Qny ^the^part of the meeting for which they were 

invited , and their visits must be occ^loned. by team or patient need. Certain types ' 
of problems, such as marital difficulties, are not discussed in front of visitors, 

D. Another--way in which information about p^^tients is shared among^ non-medi- 
cal personnel is through the Medical Care Evaluation Committee which evaluates team^ 
care of patients (usually by family). The Committee consists of the Medical Dirl^^or, 
senior internist, pediatrician, obstetrician, nurse, nurse' supervisor, Community 
Health Advocate, family health worker and dentist. The Committee ^reviews patient 
charts, conducts a review of ' deaths , adverse reactions to drugs aiministered at the 
Center, and hospital referrals. Of these, the moet sensitive is Ahart reyiew, since . 
obviousl^n the course of analyzing whether the medical team in question .has pro- 
vided ade qu a te o a r e, it also exposes^4;he^amilyi^-enti^e-meM^H| background-^o- those— 

jiot diarectly involved in its care. 

The nurse who serves as secretary to the Committee comi^ents:' "Strict confiden- 
tiality concerning Committee meetings and actions was enforced and it was made clear 
that any breach of confidentiality 'cJfeuld serve as a basis for dismissal from the 
Committee." 

The Community Health Advocate's role on the Coiimitt.ee is to bring major com- 
plaints by patients to its at.^ention. for corrective adtion, and also to submit a con- 
sume]J^^tisf action form for the family whose chart is being audited. This form indi- 
es that the family, has been made aware of the services the Center offers, and com- 
ments on the quality of those services, 

E. Special attention is paid to the confidentiality of information about 
minors. Because the Center notj only treats minors, but als9 runs special health edu- 
cation programs in the schools and in teen-age clinics, it learns of highly/ sensitive 
information about youn^ people — matters such as venereal disease, pregnancy, sex 
disorders, drug and alcohol abuse, homosexuality, and others. The Oenter sees a 

— J'troubiesome" issue in deciding' when to secure fiarental consent and when to treat the"' 
minor wi^thout such notification j For example, the Center^s rules are that emancipated 
minors are treated under their own consent. Certain "mature minors" close to but not . 
,yet of legal age and with "sufficient understandings to know 'the &ignificance of the 
consent and^the xeason therefore" wijll also be treated but the Center believes that 
"the-^safer practice^ is to require parental consent in 'these situations." If the 
parent refuses consent, a court orde^c ma^ be 'sought to authorize treatment the Center 

»«^d ih^ minor feel necessary. Venereal disease in New York may be treated in minors- 
without parental consent. Infervie^s vj.th family health workei*s confirm their critir 
cal role in assuring young p^ople^who come ^Tor treatment that the doctors and nurses 



will not tell their parents about things they wish kept^confidential, ^. • 

'^K Confidentiality: Outs id e"" Agencies and Organizations 

The Patient *s Rights booklet says that no personal 'records are released to out-^ 
side doctors, health facilities, or other agencies without the written consent of the 
patient. The Center must, however, comply with state laws requiring reports on patients 
suffering from gui^shot wounds'* and cases of communicable diseases, and practitioners 

'tell patients that they will have to do this when they begin treatment. Child abuse 
must also be reported, and"^- along with child neglect reporting this can raise 
some d;Lfficult problems for the health te^ms to resolve. Here is one account of a 

^health team deliberation about a child neglect report: ^ 

- "In this-case, the pediatrician felt a report should be made, and the family' 
health worker and public health nurse disagreed. Issues of fairness to the family, the 
po^ibility of death or injury to the child, and the effect of making such a report 
on/ the team's working relationship to a family were discussed. The family health 
Wrkers were generally against reporting because they were- not^ convinced that the 
bureau of Child i/elfare would be helpful to the family, and they wanted 'to give the 
parents a chance,* The physicians ;^ere for reporting because they had seen children 
^taaimed for life and also-felt legally responsible for making the report* 

I "In the course of several discussions. ,, the team agreed on 'the following 

/ pblicy: Data leading to suspicion of child neglect must be clearly entered in the 
chart. The report of _child neglect is not a punitive act; it may result in help ' 
being provided to a family,,, The parents should -see and. have an opportunity to discuss 
the written report before it is sent,,," 

There is a thread of feeling that runs through ®ie Center's reports, that does 
much to explain its practices as to disseminating patient information outside the 
"Celiter". Criven 'the reciMiitment"~or"the7^taf f ^f rom the^ommuhity^.And .tlie' resulting iden- 
tification with the patients, the Center *s personn^. generally exhibit a'feeling ef 
being embattled and. besieged by "outside/s" ;^ Ay federal agencies cutting down the 
-gr^t and imposing a means test on tfie patients; by city welfare agencies being unre- 
sponsive to their patients' needs; by Medicare a^id Medicaid not processing claims - ^ 
promptly; by absentee landlords not making their buildings' hab!^a^le, ThiS sense of * 
embattlement makes the Center"unco-operative '* when outside agenciJ^ demand information 
about patients that will probably be used to deny them rights, privileges-, or opj)ort*u- 
nities. The Genter bows to force ma.ieur when ,it has to, and its annual reports are full 
of explanations about why certain patient information must be supplied' to payers , wel- 
fare, etc. But even then, the Center maintains an active ]^w department tl^at brings-^ 
t^est cases against such laws or regulations, as wej-l^as sponsoring^'-^supporticig state 
legislatioil to increase rights of confidentiality. There is n6 doub^iiat tfeeljgeiitier 
use's its resources wherever possible to protect its clients, - f ' ^ 

Data Security and CoiffidentialJly ' . ^ v < /T- ^ ' ' 

The central processing unit of t.he Center's computer is housed. in a locked room 
alongside the room^ where about a doz^n staff 'members of the data processing division 
work on- punched cards, priijt-outs,* and data- input procedures. Keys to th^e computer' 
facility are issued i>nly to data processing personSiel, ^and a system of access codea--is 
used to control the availability of medical data -po' that only an employee with a need to 

. knbw about a, particular data file can^obtaln a print-out^ Similar access controls will 
be used when the Center's terminal system is 'installed. These safeguards are seen by 

'the Center's data processifig manager as the right levei to deal witli "any realist^ic 
threats to what we Ijave here , " * . 



Grievanoe Procedures at MLK ^ ' 

The Health ^dyocate estimates that his department gets about four- complaintg^a 
week of which half have to do with administrative matters like scheduling and appoint- 
ments. The others, are "\5f about employee^attitude, 30^ about treatment given by a 

^pecific employee, and 5% concera^employees not explaining thing? so the patient can 
lindersliand . " ^ , . , ^ 

V Three fourths of tlie^mplaints are resolved simply^ by a meeting between the 
Health Advocalie and the staff member involved. If this doesn»t .work, the Health Advo- 
cate goes to the staff member's supervisor, who makes a decision that is reported to 
the patient within five days. Ten per cent of complaints are resolved this way. 

If the patient is still dissatisfied, a conference between the Health Advocate 

' and patie'ntis held with the staff member and his representative, along with the de- 
partment head, to thrash the matter out. Ten per cent of complaints are resolved at' 

. these conferences. The remaining are those" in which several patients have made 
similar complaints about an employee procedure, in which case changes^ are recommended 
to the Project Director and the Community Advisory Board/. 

In some circumstances, the fact that an advocate is an employee of the institu- 
tion would cause serious concern about Qoi!«^cts of interest. Such a complaint proce- , 
dure in a police department, foiir example , usua^y (and often justifiably) raises the 
cry of "whitewa^.J- Neither community groups nor the Community Advisory Board question 
the advocate proce'ss at the Center, however, nor did any persons that we interviewed. 

,The definition of rights is so strong and clear, the advocate's role as the patient's 
representative is so firm, and the^ pres^ence of community residents on the advocacy 
staff aai seem to prevent any. tendency for the advocate's office to become coopted by 
the "management," • * ^ ' 

feeQter A ctivity on City and State Computer Data Systems 

Having made sure there is no conflict between its patients' rights rules and its 

EDP system, the ^Center has found itself embroiled during the past few years in an effort 
to see that this condition is not compronrised by efforts to build 4egional computerized' 
data systems. ^ \ 

In 1971 /lawyers from the Center's Department of Community Health Advocacy wera 
appointed to a /fCnJt^entiality subcommittee of the {Jew York City jtoyor's^slj: Force jfor 
Comprehensive health F3^ing. The subcommittee was formed to' consider what protect 
taons for patJ^I^ rights might be needed if city hospitals and health centers were 
to have their pa^lV^nt Iddta put^into a regional computerized'' data system, which was 
then ta be linked statewide planning data system. , At first, the subcommittee 

wo2?ked its^way thro^'a series of key questions, such as whether the entry of identi- 
fied patient infoni:^ion wo uid^ require informed consent in advance; who would specify 
and control access to the data system; whether the individual patient would have 
access for the pdrposes of correcting inaccuracies- and whether physicians would be'*' 
protected^ froDl' liability if the patj.ent saw — and resented — ^ certainSiOtations. 

By 1975, the Center's representatives on the subcommittee "became concerned 
about the^<jompromises of confidentiality inherenj; in such a "system." They proposed a 
ri^t b/ the Individual patient "to opt oift of the databank, forego th^ benefits of 
computerization _ the advances df science — if one esteems pri^vacy and confiden- 
tisajLty .of one 's,^ medical records ^more highly." , * ^ 

. • • 
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In 1974, to put protections against "unsafe systems" ijj^to law, the subcoiflnlittee 
proposed a two part amendment to the New York State Public Health Code', The first part 
would limit access to patient records to persons directly associated with the treating 
institutions or to third party billers; in other cases, access to records would require 
patient notarization, identifying the person permitted access and limiting* the time 
period to which access would apply. The second part of the proposal would guaranteed 
the patient's direct access to his or her own record. The subcommittee's recommenda- 
tions were under consideration during the. 1975 session of the ^tate legislature, and 
the Center was invplred in pressing for their adoption. ^ 

Observations ^ ' v^' " 

The use 'of BBP at the King Center has not Ireen as extensive as at Los Angeles 
County, or as pioneering ^s some of the other profiles we will be presenting, such as 
the Kaiser-Permanente hospitals. The Center is moving now into a iermjinal- based system 
of on-line computing, and -^his will probably lead it into a ;nore advanced stage of com- 
puter u_s age , especially ^as far as\, patient profile d'ata. 

Where the Xing Center is an outstanding pioneer is in its definition and appli- 
cation of patients' rights, especrally its provisi6n of such normally "middle class 
rights" irf a setting of urban blight, grinding poVerty, and racial-minority patients. 
It has achieved this through the support of some dedicated people at Montefiore Hospital 
but the primary role has been played by talented community residents ^heiaselves , fos- 
tered by GEO and HEW grants that have allowed^jthe Center to pursueAe^ii^.al and social 
programs. Jhat would h'ave'* b^en "Impossible without s^uch federal help. In a sense, the-^ 
Center s,tands as one of ^e few remaining monuments to the war-on- poverty dreaA of 
comraunity instituti6nS. 

But ti^e Center's continuance is far from assured. This is not only because of 
it^^dgpendence on federal grants but also because of national economic distress, the 
withdrawal of trained^ medical personnel from ghetto practice, and the danger of hard- 
"ening of the arteries in a middle-aged social institution that ,was an innovator in its 
yoCith, • #' , 

Despite all of these potential dangers, the King Center demonstrates that both 
advanced technology and respect for citizen righ4 ^ can^co eacist. The King Center qodei 
i£f there to be used by Ar^jerican society, if it wishes to, ^ , ' 

' ■ : - " ■ — 
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SOURCES 

The initi^-^ite visit in 1974 was made by Riishard Silberfierg and <i|Lmie Broder, 
who did the fir^t profile draft. Further interviews and telephone calls 'with King 
Center personnel and Montefiore Hospital staff were done until early 1976 by Helehe - 
Toiv and Alan V/estin. The final draft Wasrwritten by Westin, with assistance from * 
Florence Isbell* 

The primary'sources of published material were the Annual Reports of thf King 
Center, ^iown through the last available one, the Sixth Report (1972-73). Also of great 
help was the Center's handbook. Training Community Health Workers . 1966--1974 . 

For interviews, we are grateful to Center Director Deloris Smith; Nurse Practi- 
tioner B. Lawson; Family Health Worker A. 'DavilaV Medical Records Coordinator Eugenia 
Joseph; Health Advoj^te Liery Wynn; Administrator Kathleen Estrada; and Montefiore 
Hospital Public Relations Director Grace Urrows. 




CHAPTER 7. . KAISER-PERM/INENTE F/EDICAL CARE PROGRAM 

The Kaiser-Permanente Yedical Care Program is of interest^ to our study because 
of thre^ features that are irTcpntrast to the health care facilities we have treated 
^o fan , ' . . * 

1. Its patients are primarily unionized workers or middle class subscribers, 
not the urban poor. They pay for service, amd have alternatives to Kaiser should they 
feel that care is inadequate or their "rights" ar4 not being respected, 

2. It is a pre-paid medical plan that is both medical provider amd insurer. 
This meams that, with a few exceptions. Kaiser does not provide third party' payer s— 
either private insurers or gov^^rroient agencies— with identified patient information. , 

3. It had five years of ^experience (from 1963 to 1973) with a highly advanced 

pro.iect on computerized patient records, amd is now pursuing other approaches toward 

an ultimate hospital Information system. Neither Los Angeles County nor Martin Luther 

King Center have yet automated the basic patient record, amd tf\is makes the trials^ 

and tribulations that Kaiser underwent an importamt experience to capture. 

« 

Background 

Kaiser-Permanente is the offspring of the Kaiser industrial empire which 
flourished on the West Coast before and during World War II. In order to reduce the 
cost of employee health 'care, Kaiser set up its own system of hospitals, clinics amd 
participating ph^^sicians. At its height, the Kaiser program met the medical needs of 
100,000 employees. 

When layoffs after the war caused memb^ship in the medical plan to drop below 
.1^1-, 000, a decision was made to open the plam to the general public. Today, the 
Kaiser-Permanent^ program is the largest^ group medical plam in the country, a 
six-region cooperative system providing "total" medical csure for 2.6 million people 
in California, Oregon, Washington, jiawaii , Colorado and) Ohio. It has 50 clinics, . 
23 hospitals amd laboratories amd employs 2,595 full anci paurt-time physiciarvs 
throughout the vairious Permanente f?^dical groups. Though there are differences in 
^benefits among the vairious plauis, most pro^ride comprehensive coveraige, ramgiog* f rom 
examinations and inn oculat ions to long-term hospital care. It is non-profit, under 
the 'aegis of the Kaiser Foundation Health Plafi. 4 < 

When the^Kai^r plam was first begvin amd limited to its t employe.es , it was 
considered a radicA -venture _amd airoused considerable hojstility fr9m some sec^tors of 
oreamized medicine. Its physicians were salauried, and most still are though some 
are now partners receiving percapita ^aires. This use of salairied doctors evoked 
from conser^ratives protests against "tne corporate practice of medicine."^ Coupled 
with prepayment, this, raised even morgi fervent protest about ^socialized medicine" 
amd "destruction of the doctor-patient relationship." 

Attixudes-have changed in the laist thirty years, amd there i^ now broad 
^cognition that Kai^er-Pfermamente provides some answers to widespread medical 
problems.* With a salaried ^taff , tJ^ere \s no physician incentive to encourage 



* See Sheila'K. Jphnson, "Health Maintenacei It Works,' 
N.Y. Times' Magazine, April 28, 197^, 3^. 
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.unnecessary (but often^of itable) surgery and hospitalization. Prepayment enables - 
Kaiser-Permanente to emphasize preventive medicine— catching health problems before 
they become costly in human or economic terms. Kaiser-Pfermanente members' **spend less 
than half as many days in the hospita"^ as other Americans." Prepayment (oXso keeps 
Kaiser-Permanente premiums 16w - $600 a year for a family of three or more^ well 
below the average payment for care in other plans and programs. ' 

The Kaiser *lrystem has not been ^ithout criticism. Some subscribers complain 
that there^ftfe not enough physicians, causing patients to wait weeks for routine 
^appointments. Some patients^ feel the doctors shunt them' through their examinations 
too quickly and impersonally.' One subscriber complained that he feels "like a cog 
in a machine." There are occasional complaints, but measured by the ultimate test of 
^opsumer satisfaction— renewal^ of membership by 2.5 million persons in a voluntary 
plan where there are ready and varied altematives^-the Kaiser-Permanente program 
obviously offers what a great many individuals and families are seeking in health care 
Computerization at Kaiser-Permanente 

Kaiser-Permanente* was a pioneer in **multi1phasic health screening," in which 
yearly intensive examinations' are offered to members along with a battery 'bJ tests 
desired to identify health problems early. Starting in 1950, the multiphasic • 
screening was supported by card-punching and sorting equipment, in a manual record. 
But the Resulting records were ^unorganized and difficult to use. Patient folder* 
stuffed with documents such as lab results, surgical summaries, doctors' and nurses' 
notes, identification information, and sometimes even basic .accounting data. In 
most cases, the physician lacked time to review the record and was forced into 
liurried extraction of those items .critical to the patient's current problem. In 
addition, manual record-keeping costs were very l^eayy, accounting for 29% of the 
"hospitals '. operating costs.- • \ * 

Ifi i960. Kaiser Medical f^ethods Research began ai«*pilot study, funded partly by 
the U.S. ^Public Health Service, to see how computerization might improve patient 
recoi^d keeping and data communication. Based. on that study, in I968, the National 
Center for Health Services Research, an HEW agency, awarded Kaiser-Permanente fxinds 
to develop "a.compu'terribased system that will support «the medical data re(5uirements 
of one million health pl^ ^members, one thousand physicians, and a large corps of 
professional and para-medical contributors to patient care." The first step was a 
pilot project conducted in the San Francisco Kaiser-Permanente facilities, covering 
130^000, Health Plan members. 

Before goih^ on to describe how the computerized, patient records pilot program ' 
Worlds, it IS important to note that it" is only one , component iii Kaiser's record * 
keepingcrogram. .The other record-keeping elements atei , y 

Administrative and FineCncial Records \ 
^ ^ AS in-many other medical institutions computerization at Kaiset began in 
the early l950's with accounting and billing. By 1973,ltherjB .were ."more than 400 v 
programs utilizing EDP in administrative and financial kreas. This includes . * 

generating group direct billings, mappirtg address and cfoverage changes and providing 
statistical profiles." These administrative and financial records arejcept separatjfe 
from patient records and stored centrally. ^ 
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2. Manual Patient Reoords 

All patient records, except those in the piiot computer p^^ogram, aire kept 
and stored manually in the offices of pairticipating physicians and within Kaiser- . 
Permanente health facilities, Wanual records for patients in the pilot project 
also continue to be kept in this way, since the^ computerized records are in addition 
to, not in replacawent ^f , the old records. 

T)ie pilot project system was designed to make the computerized record (Patient 
Computer Medical Record) the fundamental repository a^d basic source of patient 
medical information . , Each computerized record was to be "a continuous lifetime record 
cor\iaining a!l essential present and future inpatient and outpatient data, including 
patient data from any facility eind any location," As in the manual record, the file 
included Kaiser-Permanente medical record number. Social Security number , name, 
birthdate, sex and blood type, plus enough identifying information on family members 
to permit cross-referencing. The medical datSi section of the Vecord included 
historical information on past illnesses, observations by physicians, test results, 

preliminary and finn diagnoses, and reports on medical procedures ordered and/or 

.performed. Financial and administrative patient data was stored separately, as with 
the r^anual system. The difference, then, between the manual and computerized ^patient 
records is not so much what went into them, but the greater ability to extract 
information from the computerized 'record, and to make additional research uses of 
the patient data base*-. \ ■ - 

For example, with the computerized record, a physician in the Emergency Roopi- 
could receive a report containing laboratory .data, multiphasic data, and a listing, 
of^ithd patients previous visits. Or, the San Francisco outpatient pharmacy could 
enter the date, time and drug data into each patient's computer ^dical record 
through interactive typewriter terminals^ and the computer would then print 
medication labels. To refill ^prescriptions , the old prescription number £tnd refill 
code would i)e entered and/ the entire/ label wouid "be printed. 

The Director of the Medief^'^thods Research Group which operated the pilot 
project is Dr. Morris Collen, a pioneer in computerized medical information systems 
He believes strongly that nhe advent of computers into the community will undoubtedly 
introduce a new 'era of improve* health caire delivery. In addition to the creation 
of, computerized patient medical records, the specific objectives of- the pi'lot project 
includetl^ computerization of all laboratory testsj development of better communication 
and reporting services, such as immediate (real-time) reporting of essential^medical 
data via inter-^ctive^^erminals in ^the emergency room or at the hospital or fcllnic 
nursing ^tationsj testing of an admissions census system; testing of acquisitions of ^ 
physicians and nurses reports in the, .pediatric seijv'icej acquisition of aiddiTional 
selected medical and administrative data, such as hospitalization utilization data. 



•At one time it was believed that the Social Security nimber would become a 
required ujiiversal identifier, and it was asked for that Jeason. But Kaiser no 
Ifinger thinks. this and dontinues to rely on its own numbejrifig system. 
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Starting in 1968, the^ pilo-i| study aj^lications were run on ain IBM 360/50, but 
were changed in 1973 to an IBM 37p/l55* Telecommxinication terminals were located , 
alXthe computer center and at thr^e Kaiser facilities: Oakland, V^lnut Creek and 
San Francisco, The Walnut Creek -terminals Jnand2,ed only multij)hasic data, while the 
Oakland facility had nurse practitioner station and health center terminals in 
addition to a multiphasic 'one. The most advainced system, and the core of the project, 
was at the San Frsincisco Medical Center; the terminals here included admissions, 
emergency room, qlinical laboratory, multiphasic program, pharmacies, outpatient 
encounter forms, and hospital system. By 1973 » the outpatient system was handling ^a 
daily Volume of 2,000 patient visits, 1,200 clinical . laboratory specimens, and 
},500 prescriptions, in addition to 300*daily multiphasic visits. More thVi 400,000 
subscribers l\ad their medical data stored in the computer. 

Citizen Rights in the I^jser Pro.iect 

1, Confidentiality ' ^ * 

The Kaiser-Permemente Service Agreement contains the following statement: 
"Information from medica\ records .of Members amd information received by 
Physicians or Hospitals incident to the physici^an-patient or hospital-patient 
relationship is kept confidential, and, except for use incident to Ijona 
fide medical reseaurch and education or reasonably necessary in conne'ctl»n 
with the administration of this. Agreement, is nof disclosed without the 
consent of the tnember," , - 1 __ , 

As jioted at the_outset. Kaiser is a pre-paid pl£in,*Its subscribers do ^ot have 
to file claims or claims information. And since ^[aiser Itself is the insurer, no 
outside non-medical agency shares patient information, ^ / 

There £U:e some exceptions, 

Five percent of Kaiser's revenue comes from patients who receive Medicare and 
Medicaid? and one percent comes from MediCal recij)ients* Authorization is secured 
from these patients to send required information to the appropriate federal and state 
agencies, - • ^ 

When a patient is admitted to a Kaiser Foundation^'hospital, he or she signs a ' 
jform which includes tJie statement: "The hospital is authorized to furnish from 
patient "s 'record requested informati^pn or^xcerpts to any J.n surer of patient,** 
Kaiser-Permanente also has a separate^f orm authorizing them to furnish a^ designated 
party with "any and all medical information, history, records, dl^CToses, reports oV 
x-rays in your possession concerning the undersigned," \ 

, These two forms obviously authorize a broad range of information sharing, 
and patients are^not toTd that they have any option to sign or not. 

Recently ^ attorney who checked in»to a Kaiser Hospital for an abortion deleted 
the release-of -^information part of the consent form. She sala it wa^s "coercive , and » 
anxiety-producihg, potentially incriminating to patients, and/from the ho^pital*s 
point of view^ legally unnecessary," When she explained this objection to the 
resident on duty, he called a "medical-legal" advisor, whq told the patient that she 
could delete >th.e paragraph, 

■■ • - . , . ■ -.. - 
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James ^ Sexton, SiJCaiser admini'stVative official, says that the most frequent 

demands on 'patient records from /secondary users come from three source si life 

insurance companies, attorneys, and law en;forcemen.t agencies. Insurance companies 

h^ve to obtain a~re lease from the patient an<| they do not generally ask for 

unauthorized inf oration. The attorneys are usually representing patients in 

malpractice or third-party liability cases. As to law enforcement agencies. Sexton 

said that lacal police usually do n^t try to obtain information because they know 

Kaiser personnel are reluctant to give it. However, if the FBI is seeking ^ i 

information, Ka|ser-Pe*rmanente officials "like to'cooperate, " They wilj. not divulge 

any medical information, but they will usually answer FBI questions as to whether 

an individual was visiting a Kaiser facility at a paLrticulair tinve. Th&^e qccasidns 

are infreqiaent, and in eaoh case, the facility administrator makes the deqision about 

what information to release. ^ ' - - 

♦ 

No medical information is provide'd to employers unless the paptient speaifically 
requests it. An employer can request a baCk-to-work slip from an employee's physician 
but no medical data is included without the patient's signed authorization. Kaiger- * 
Permeinente will not normally include psychiatric information when releasing a record; 
their psychiatrists aire paLrticulairly concerned that there be no leaks of corif idential 
information. " ^ 

In addi?ion to record shairing with the abo-ve groups, KaiserrPermanente , along 
wixh "alt California medical ^aiTe providers ^ " are legally" required to supply government 
agencies, with certain information. For example, all infectious, contagious or 
communicable diseases must, be ^reported to a health of ficer inpatients who suffer lapses 
of consciousness are reported to the State Depairtment ,of Motor Vehicles injuries 
inflicted with a deadly weapon go to local law enforcement, official; injuries / 
deliberately inflicted on children under 12 go to the j\iyenile probation'liepartment j 
and physicians must maintain identified records on the di;^pensing of dangerous^ drugs 
for at least 3 yeairs, and- these rei^ords are open to inspection by authori^d law 
enforcement officers. Kaiser-Permanente must also file certificates of defith, live, 
birth,- and fetal death where the 20th week of gestation has been reached. • The*iirth'. 
and fetal death certificates list the father's occupation, and the^ birth,, cert if locate 
has both parents* social security numbers.^ Some Kaiser facilities also report the'' 
ijClentity of patients with malignant tumors to the California Tumor Registry, buti^ i 
this is voluntairy. ^"^4 ' 

Though such duties aire generally performed, they are Act always done. However>^' 
Kaiser personnel could not recall any physicians b^ing harrassed or prose oated for ''Sy^ 
not meeting any of these legal reporting Requirements . \ 

In addition to these public reporting exceptions, the courts can subpoenal all 
or 'parts of the medical record. The California Medical Association rules on 
confidentiality, which Kaxser^ generally uses as -a guide, includes'' xhe following^ , 
policy oh court demandsi ^ ^ I • . 

"The Were /receipt of a subpoena does not^ necessarily ,justify| disclosure^, 
without further permission of the patient^ of private information. Since the patient 
may sometimes be able to assort the physician-patient privilege notwithstanding the 
existence of a subpoena, the^hospital should, whenever possible, alert the patient 
of th6 subpoena and of the time and place of hearing (unless the patient^ista party 



to the action and has therefore already received notice), so that h^ may make 'timely 
objection to the disclosure.** \ ^ 

However, in practice, Kaiser does not follow a 'policy of notifying patients in 
advance of subpoenas, anti nothing in the subscriber's agreement warns patients that 
their records may be given to various government agencies under compulsory reporting 
requirements, or subpoenaed by a court. , ' 

^ ' The above policies as to confidentiality and disclosure apply to all hospital 
records, whether manual or computerized. When the pilot project was started. Kaiser 
adopted a rule that "each Patient Computerized Medical Record ih the computer center 
is subject to the same 'regulations governing release, privacy, and confidentiality 
as is a 'record in the hospital medical chart rdom^. - ' In addition, some" special^ 
regulations were adopted by the Hospital J^ecords Committee to s^eguard computerized 
records. 

All terminals were opened and closed by action of. the computer operator only. 
The emergency room terminal, being the most vulnerable, was placed in a restricted 
area and the terminal operator there had to know a v^lid 5-digit number to operate it. 
Other terminals required the use of aplastic card, and a comprehensive card-and-key 
system ^/tfas- contemplated for the future. Each terminal contained only , the data 
prescribed by the program controlling t||iat terminal. For. example, the ^^ypewritd^r 
terminals in the San Francisco outpatient pharmacy were activated only by the 
computer -operator -in Oakland who started the pharmacy function program, . .»*Only data ' 
entry and data retrieval as programmed in the pharmacy function was^available at 
the pharmacy remote location terminals," and this was via private (not dial-up) 
telephones. ♦ \ ^ 

When the emergency room terminal was in operation, the Medical Methods Research 
group instituted an audit trail. Each request was logged, and the log was published 
every morning. Although designed as a security measure, it was used more as a study 
of utilization patterns. Dr. Collen says that it became necessary to prevent data 
being collected by one research project from being taken by other groups before ^he 
original group could publish its findings. 

The Hospital Records Committee is responsible for new podicy decisions affecting 
computer confidentiality. For e^tample, initially when ,the Emer^icy Room received a 
record of patient visits, ^psychiatric visits were included on the) list. Members of 
the psychiatric Department' brought the issue to the Committee, protesting that this 
data ^houl^ not be available to non-psychiatrists. The Committee agreed and excluded 
this information from the emergency room terminal. , .1 

Manual records contintJe^ to b6 stored in central record rooms under ithe ^^..^^^^ 
supervision of ' a medical record administrator. | These are filed by the pJtiervfs 
medical record number and must be signed out under the responsibility of]a physician. 
Psychiatric records^ are stored separately and special' periiission is kquired for 
^ their use. When the patient is in the hosf)ital, the. patient record is.m^ved to t>ie 
,a^t>proBriate ward, where it is storey in restricte^ff iles at the nursing station. ^ 

Local civil liberties groups interviewed in the Bay Area feel that KaisW-' 
Permanent e is conscientious about the privacy of patient medical records . They\ave 
heard of no incidents involving Kaiser. \ 
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2 ♦ Patient Access * ' , . - ' ^ 

Under California law, the patjLent's record is the 'property of the phys'ician. orj 

hospital, 'and the patient has no legal right to see It, But the patient's attorney, 

with writtefrtuthorization from the patient, must be given the recoi:4 for inspection 

and copying. Previously, this ri^f applied only after the filing of a legal, action,^ 

but that provision wds amended and now he may have access before an action is filed. 

Indeed, there is nothing in the statute that prevent an attorney from access ta his 

client record even whery no legal action is contepiplated , 

A^ttatient who sought to see a letter he had requested his physician' to write- 

was told»y Kaiser-Permanente that it would release the-* letter only to his attorney, 

upon request of the attorney and with a release signed by the patient. The release 

.form contained a mandatory indemnity agreement under which if the patient ^sued a 

third party, and recovered, he muJ^: reimburse Kaiser for the cost of his c&e; 

When an attorney does gain access* to a record, £^ monitor is always present while 

the attorney copies it: Mr. Sexton stated that Kaiser often tries to provide or^ly 

the portion of the record .they cpnsider relevant, but if challenged, he fe^ls they 

must supply the patient's entire record. He remairked that theoretically/ a patient^ , 

acting as his or her own attorney could gain access to the record, but he did not 

think this had ever occurred, ^ . * 

Patients aire ^Iso entitled to information from the record when they need* it 
_ _ _ ...^^^ H 

Ske a decIsTon about future treatment , ^The California Supreme' Court found that a 
cian **has a duty of reasonable disclosure of the available choices with respect 
oposed therapy and Qf the dangers inherently and* potentially involved in each," 
Most physicians and medical administrators aire not enthusiastic about patient 
access to records, and the staff at Kaiser-P6i3nanente adheres to the accepted 
professional view, Mr, Sexton 'says that Kaiser-Permanente do^s^ not allow patients 
access "principally because it's a nuisance," Patients don't undei^stand theVecord, 
he believes, and the physicians then have to interpret it, which they •'don'^t have 
time" to do. In addition, •^unnecessairy questions are raised in the patient '^S^mind, " 
Sexton added that Kaiser is '•paLrticulairly circumspect about giving out medical 
dnf orination because their great size and visibility msike them vulnerable to 
malpractice suits, ^ , , - 

Kaiser-Permanente patients have seldom asked to see their own records; this ^ , 
occurs perhaps once, every six months. The "patients' assistance" personnel Kaiser 
has in each facility recently circulated a form asking patients to list their 
complaints, to see which one.s. arise tmost often. No complaints about lack <5f a^ccess 
were listed. Interviews that this project conducted with a small group of Kaiser 
subscribers confirmed this situation j nope of them had ever requestecf access to thei?: 
records, though all were under the mistaken impression that if they 'did ask to see 
them, permission would be granted. 



Termination o!f the Kaiser Pro.iect ■ and Future Prospects v - 

At the height of its use, in^l973, the HEW grant fo^: the pilot project (which 
accounted foij^vhalf its funding) was terminated, to the surprise and dismay of Kaiser 
officials ancj many computer' experts throughout the country. " ► • ^ 

Because the Kaiser Foundation Healtl^Blan, which had put up tHe other hair of 
the money, was not able to absorb the extra costs, mucK of the system had to be * 
dismantled.. Some of it has been preserved on several minicomputer systems for 
discrete functions j automation of laboratory tests is continuing in a limited! way 

^ by funding the Santa Clara facility with a $350,t>00 laboratory project and the 
pharmacy system has been given funds by the Kaiser Family Foundation, But the on-line 
computerized records, reports to^ the emergency room, and delivery of records vfa 

, terminal to the facilities have been, ended. Dc^r^Collen hopes that sometime in the 
future t^ separate systems that are in' operation may be linked togetl^er, 'ai^d they . 
have receiVt?4^a grant ,to study the requirements of each .mini-system anc^^'the criteria ' 
to connect them. * 

. There are v.arying opinions as to why V^*^ funds. were^ cut qff.* Dr, Worrig , * 

Collen, Director of I\redical Methods Resear^ch, believes it v/fs p^arily ^a qj^^stion- 
0/ ec9nomics." He aiso noted^that computer technology is not a current priority in - 
tW^ medical field in tMl country, and expressed the opinion that the pr^g^ent climate 
for research an'd development in computer (Operations in hospitals "is the Worst in the, 
past ten years. In addition, the difficult financial cdilndte wis oomplicated'Vy 
the .Nixorf Administration's impoundment of health appropriation funds. This created a 
situation in which the question was not whetjier cuts would be made, but only where ' 
they would besmade,' , „ 

Several other, computer scientists in the health services fie id ^explain the 
cut-off with additional^ reasons. Though >ts multiphasic screening program is seen 
by some medical specialists a^ a highly-valuable system^^whose benefits would take a 
decade to measure objectively, critics say tjiat Kaiser ^failed to of f&r convincing 
documentation that its multiphasic screening program wasVe^ucin^ ill!?ess aml)ng t 
.Kaiser-Permanente patients. The syst^^m .proposal also promised a more advanced ^ and 
» more highly * implemented patien^ data base sy^em than Kai§er^fermanente was ai^e to 
deliver; and reviewers may have felt 'the project 'should have aftcomplished morAhan 
it had at the t^me the grant was dropped, Su]pporters of tfje Kaiser project sB^HKW' 
action as representing aji insufficient, a^j^^ation' of how i^uch time-rand monej^t 
takes to innovate in hospital comput^rizatft^beyond «the weil-establisheci * ^ 
admin^trative ^d laboratory applicatiorfs , ' - ' * ' ^ 

One aspect of th^ -Kaiser patient record project that did not drayv|criticism was 
it3 policies and procedures for injuring confidentiality and security of patient data* 
in the' system. In fact, the protec'tio^k developed by* Kaiser have been adopted by 
,other advanced hospital projects. On the .other hand. Kaiser's policies as ,to informed 
consent and patient access to his/her own record were not^affecterf by, compute»>izationi 
tl:iese remain matters of medical and social policy^ on which Kaiser^ policies reflect 
the mainstream of cui^rent medical opinion, , • 
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■ Observations • 

^Informed opinions differ as to why the Kaiser project did not accomplish as 
much as its sponsor^ had thought they could. There were problems with hardware^ and 
^oftw^re, resistance from some medical staff, and funding delays and uncertainties 
that derailed schedules. "*But a recent paper tjy twa experts working in Kaiser's 
Santa Clara project, Robert Harrington and Con KorenoSF, su^estS that "the current 
barrier in medicaO. information systems is conceptual ratner than technical,"* i'inanc^ial 
applications were adopted by hospitals from the industrial models, and^ laborator.y 
applications ^rom the processing ^of large amounts of numerically coded data, But 
the patient record application, th'ey note, poses the problem of documenting 'how 
medical professionals actually practice, and organizing a mixture of facts, 
observations, and speculations into a record that physicians will need— and use — at 
% future date. There are presently no clear conceptions about how to do that. 

Their comment underscores the fact that^even at Kaiser — where many of the - 
physician roles and rewsirds aire more preventi-ve-h^&alth oriented and l^ss ^ 
individualistic than in most ho.spital^^ — the ques|ci;m--<?f exactly what medical ^ 
professionals now do, amd what they would be willing to do in the^ future, is at the 
core .of -ar.yv effort to extend computer use into direct patient care, Dr, Lawrence - 
Weed has noted that computerization is threatening to doctors, because they have 
traditionally been paid for using their memories, and a computerized system 
institutes.. **a different set cS* rewards.^ and r^qtlires shairing of power with other 
health professionals." In addition, Sr-computer system introduces a discipline that 
majiy doctors and nurses do not want to. accept, and against which they can always * 
invoke the argument that "attending the patient comes-<<irst , " 

Thus the Kaiser experience shows that we aire bairely ready to start applying 

^ "central data base" concepts to the hospitals,- Ainer^ican society, is reconsidering 
how health care should be organized today, whether for a subscribed group, regional^- 
population,^ or as a national "system". Given the' mixture of personnel facilities, and 

^ technological resources available for the effort, it is npt yet clear how patiertt 
information can best be collected, stored, and used in suppor-J: of the total health- 
care^system. ^ In term^ of citizen, rights issues, this means that if we are ready to"^- 
do so, there is sti^ time to pay attention^to citizen rights concerns at the blue- ^ 
print stage of hospital information sy^^fems , rather than to, have to r^sh into action 
later, as am 'afterthought , ^ . , ^ 



' "A New Look at Ambulatory Health Informa^j^on Systems," ^ 

Information Technology for Public Servicfs^ Engineering Foundation Conferences, 
^ Sept, 15-20, 1975, Asilomar> California, 



**Commentat NBS Conference reviewing this report, ' • ' \ 

September l6, 1975. * • \, 
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- V CHAPTER 8. THE U.S. INDIAIJ HEALJH SERVICE - 

, The approximately 850,000 Indians in the XJnit6d ^States are part of. American 
society, but not quite. The majority of them, live on reservations as wards of the^ fed- 
eral* government , under a complex mixture of federal and tribal law. Indians are at the 
bottom of the nation's economic Iddd^, with average yearly incomes only half that of 
the white populatioa, and Witho%^t the upward mobility that other racial minorities have 
begun to achieve. In terms of health, Indians are far w(^rse off than whites and blacks 
cfespite dedicated efforts by'personnel of the Indian Health Service, facilities and 
services of IHS'ara so bad that they have been called, without much hyberbole, "an 
American travesty." • *^ ^ ^ • 

BecausiB 'Indian health is a responsibility of thd federal government, growing out 
of* earlier treaty guarsintees , the Indian Health Service has had a chance to bring. ad- 
vanced ComputerLand' communicat.ions techno logjj'- to bear on these problems; the Papago 
Indians' computer project *fe will examine is regarded by many as one, of the most ad- 
vanced problem-oriented record systems in existence today. What effect it has had on 
the quality of health care in its area and its chances for inpreased use throughout irfs 
are issiies we will be considering here. We will also be looking at citizen rights is- 
§ues .in terns of some differen^t conceptions of privacy arfong Indians than those held by 
the rest of the American population. ^' , - 

Indian Health Problems . , . ^ ^ 

The 1970 Census reports that there are 827,000 Ameri,ean Indians, including Alas- 
ka Natives, g^imos and Aleuts. The health statistics below' come from studies of the 
500,000^ Indians liAtiag on reservatlbns . 'The Indian Health Service^ (TUS ) says that it 
has little information about the health conditions of the ^remaining Indians who live^ 
•re^rvation, since it is only vei^ recently that the^ Service "has begun to provide 
Indian^ health carje centers in urban, areas. Because of the continuous shifting of In- 
dians f rom^cities to reservations and back again as employment opportunities increase , 
and decrease ^a^d as cidture conflict create^ ^"ressures on Indians to accept jjr reject 
.reservation life, IHS ,J)elieves that the ^health situation of on and off-feservati6n In- 
dians is very .similar. It is a grim picture. 

The Indian d^ath rate from^ tuberculosis 'is almost jfiye times higher than in the 
rest of the population^" from intestinal diseases (g^stl^itis, colitis, e-tc.) almost 
four times greater; from influenza and pneumonia about twiee aa high; from post neo-« 
natal diseases (infants Qne month to one yeat old) more than«four times as 'high. The 
accident death rate is more than three times as high, of which a major ingredLsz^t is 
motor vehicle accidents . thought to be associated with fe.lcjDholism. ' In this donaection, 
Indian deaths from cirrhosis of the liver qp:e*more than two and a half times higher 
than the rest drf the population. / - / 

The oVer-all age-adjusted death-rate for Indians is*;40^-higher than th4 rept of 
the population, even though significant decreases' in deaths from certain diseases such 
as tuberculosis, influenza, and pneumotiia have occurred in the past twenty years. 
While th^re^^has* also been improvement \n. the rate of ^ndian infaht deaths, the death ^ . 
rate for new bptn infants ^s still 23.5 per 1 ,000 births for Indians, compared j/ith 
16.8 for whites and 19.2 for the total population. Meanwhile, the Indian morbidity^ 
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rate- (illnesses) continues to rise sharply, especially for strep throat, influenza and 
. pneumonia, and atitis media, (a disease of the middle eai* that can cause deafness), " 
. Dysentery is 54 times more prevalent am&ng' Indians than non-Indians and syphilis four 

times more prevalent. The morbidity rate is higher \oday for Indians than for any 

other population group, and in every single reported 'classification. 

Special Aspects Of Federal Health Care Delivery To Indians 

Indians are wards of the government, and the fedeVal government undertakes to 

provide directly for their health care 1>hrough the Indian Health Service; an agency of ' 
' the Public Health Service, which in turn is a division of the Department of Health, n ' 

Education and Velfare. 

Placement of the IHS under HEW reflects the conflict between those who would 
integrate Indians into the American n^instream, arid those who would' preserve' tribal 
culture, V^ien the Indian Health Service was established in 1921, it was pai:t of the 
3iireau of 4$.ian Affairs "of the Department of tha Interior, By the 1950's the health 
of the Indians had deteriorated so alarmingly that the Hoover Commission recommended ^ 
that it be put under aegis of the Public Health Service' because "Indian Health Services 
would be under direct m^ical supervision, which was not 1;he case w^th the Bureau of 
Indian Affairs, where the supervisioi lay with agency superintendents and others who 
were not medical professionals r." ^ * 

The transfer to HSV was made' in 1955. Despite Congress ionikl Meanings - toward 
termination of special Indian prograas, IKS has grown rapidly sinceN<hen---from a st^tf 
of 2,900 and a budget of. S3^i3i^lli3n to a present staff of 7,400 and a budget of $200 
million, ^ , ^ 

The Indian Health Service program is carried out through a system of 51 hospi^ 
''tals (ranging in size from 6 to 276 beds)^, 77 health centers, ^and more. than 300 health^- « 
^ stations and satellite field clinica. Additional medical and dental clinics^ are held at 
appointed- locations on a regular daijly, weekly or monthly schedule.. Special clinics- 
are held intermittently as needed. |[HS also conducts health examinations, immuniza- 
tions and health educational pro'gramp |in reservation schools run^.by the Bureau of In- 
dian Affairs. In addition to convenjtional health care,' IHS operates several special 

maternal and child care, family planning, and ssmi-* 



Among them are nutrition. 



programs ♦ 
tation.. 

However, measured against othor health care provided directly by the federal 
^^^over^iment , i'n Veterans hospitals fo^ bxample, or against programs funded by the fed- 
^eral government, or against private ieiical care, the sjbaffing and facilities in th^ 
Indian Health Service are woe full;i^/ii^ai equate. A study conducted, by the Senate Perma- 
nent Subcommittee on Investigationi xn 19,74 revealed that of 51 hospitals maintained by 
IHS, 29 cannot meet the certification ^standards of the Joint Commission* on .Accredita- » 
tion. By contrast, the 171 hospitals ]'un by the Veterans Adminstration are all accred^- 
. ited. Thirty- five of the Indian hospitals do not meet, fire and building code regula- 
tions. * I 

The Senate Subcommittee foi^nd Iiidian Health Service workers to be "an extraor- 
' dinary grou^ of deeply committed, hard-working people... We found them -providing care 
in crumbling, ill-equipped federally owhed buildings. We found doctors wbrking 80 ' 
hours a week. We learned of a nurse who collapsed from fatigue and heat during patient 



childbirth in an unventilated delivery room. 



We found staff shortages so severe that ^ !«, , 
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'> .entire, wings of 'hospitaiff had to ,be^ ^'closed. , ' t 

Jhe Sena.te inyestigators reported, that in one fajospital there ^as a '"backlog of 
1,500 surgexies needed 'to. repair the damaged eardrums of children suffering from otitis 
media. ..so'mfe. rfayaho have been waiting ten years for surgery One IHS doctor told' the 
. iijvestigators*; "^e, see people 4i€ of .treatable > curable diseases, Ve see people (Jie of 
, , diairrhea, diabetes, infe^ctionife, rheumatic heart disease, typhoid fever, diphtheria, 
Tkese^^^would not, "be- tolerated anywhere else in the United States • Here it is a way of 
life,'' • ' : ' ' - , ' >• ' ' , ^ ' . - . 

In addition to understaffin^, there is ^he separate ^d chronic probleto of high 
,'staff turnover. During 'the .Vietnam war, the IHS ^ was staffed largely 'by^ doctors who pre 
f erred the Health Service to tl>^ draft. , T^ey would serye the required two yeaxs' and 
then leave. IHS foj^esaw an ^ even higher t»ii;nover with the end of the draft. 
' !IJie high, turnover of d#ctors and other professionals, and the lack of training, 

fosters a l^clc of uniform procedures add* record keepixig. It also means that there is 
not, the ti^ie to develop good communications among the various pro fees ionals-r-spci^^ 
workers, sanitarians, physicians and* health workers — who deliver health care to the In- 
^ dians. . . / 

Contract And Dhird-^Party Medical Care ' * 

. Mn'places^where .there, is nc^Indian Health ;3ervice, facility or health facility ^ 
the IHS contracts to pay for health care given to Indians by outside hospitals and phy- 
sicians. It has made such contracts with over 500 private and community , hospitals , 
with 20 State and local health departmentiJ,. and with 1 ,000 physicians, dentists and, 
other health Specialists. , . ■ ^' ^ ^ , - 

. /Where there is no contract medical care available, Indians are theoretically en-' 
titled to the same medical benefits as other citizens: partici^pati^ inr , Medicaid J and, 
other f<ederai state and local programs available ta low-fiiicpme c^Aizens, including^ 
treatment at 4>^blic hospitals. Bjut Medicaid and other staie-'S^miiiistered j3rograms do 
nQ,t coAsider tiiemsSlves respoji^ible for Indian health care*^ ^^InJians >/ere not calcu- 
lated either ,by HE>f or ^ the states ds, amon^, the consumers of such services when they' 
Wei^e^-iirst^ budgeted, and some states, delil>erateiy did .not inform Itidians that they" wei^e 
eligible for them^v .A law suit recently "brought by a group of Indians, in Ariz oiia has 
forceti belated notification, and threats ,of furt^her suits may speed, up the .^^o^cess, in 
' other states. ^ ' " ^ \ ^ - _ ! s.^^;^ ^ s'^*' r \ 

An Indian, seeking treatment in , a. puj)lit3, hd)apit)al is Ij^^ly to ,be turned aws^ 
with the excuse that "iHS facilities must take reet)OnsXb:ility^,fa^ his or her caxe,^, even 
though there* may, be no suchlCaciiity within, hundreds pf^^^miles. As to ^ledi.oajre , IHS, \ ' 
will not pa'y,fe)r^ the ^monthly \premlums, put of its contraot^medicino budget. " It -argues' 
that it can only pay fb^ carVsthat^iS* ac^uallj: giyfiif nol^ f Sr^ pren^iums, ^gainst the 
possibility thai ca^-e mights be hee^ded^. .The \am^ ^oi^^ true for-^ private health insur- 
. / ance pryiSiums^ -.^^ "^V , \' « :f ^ . >n v - * ^ ^ 



Indian/ Health '^Boards ^ ^: 



Most Indian Health Service Unit Areas , have Indian. Heal tJa Boards composed, o'f , 
tribal , members who ed^i^IHS on^medic^ polioy and programs. Jja some jat^e^as^ the Bo^rd 
Mas been functioning ioi^t numbey of ^ years ^ ,and its members, h^s adquiped some bac^- 
^.'ground in iiealtli pi^obleis. In others, .the Boards are Just being created. S^6;ae health 
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w Boards have well-defined functions suoh as evaluation , of IHS from a consumer point of 
view; handling individual consumer coaiplaints; monitoring IHS contract programs, etc. * 
Other Boarcts limit themselves to interpreting .IHS programs to. the rest of'^the Indian ' 
coinmimity* ' . ' " > • ^. , ' 

Since the Health Boards do -not have officially defined functions and there are 
•<io mutually agreed ..upon Sidelines ? a great de^ depends not only on the Board's per- 
ception^ of \ts ro|.e, but>n^the IHS staff willingness' tc^ cooperate with the Board, 
acid its sensitivity*, to Ihdiah' customs and ciilture. In some Service Units and Area of- 
-ficesv^tiiere is a warm feeling of trust tod mutual cooperation; in others, the 'Relation- 
ship is^ a pro^ forma affair wii;h.littla r^al in^Jfer-change in still pthers, there is out 
right hostility. • *' ^ * ' • 

Problems Of Di&tande^And Mobilityv - 

. /The^Ihdiaji Health Service comparefe its health care' to that delivered in ghetto 
health care programs. This is true ij? the s^nse thai both encounter the dis,eas"es of 
poverty.' But the^ delivery -o;f he^th.care to Indians is complicated by their isolation 
~a relatively'^ small population 'in a 'vast area with hundreds of miles of unpaved roads, 
that a^ often impassable '.lii winter. The Navaho reservation, for instance, on which 
130,OOGr^Indians^live-, is^tne size of West Virginia. In some parts of this reservation, 
th^viiear.est^hospit'al is 80 miles away, there is no ambulance service, and many *peo pie 
•do noVhave any other form of. transportation. In addition,, many JEndian.tr ibes are mi- 
gratory^, ^he constant shifting ^of po.pulati6n'W"and off the reservation has already 
been, noted; But Indians on. the reservation also migrate within it, following seasonal 
agrieiuitafal and^ eaploymeniN opportunities. According ta V.H. Chadwick, Deputy Director 
bf the IHS, many^ Indians "will visit hot a facility, 'but facilities across the geogra^ 
^h^we' serve;... Some Indian people.^, .have as many as &lx or more Social Security .numbers 
b^cau^^t is e.a^ier to;^^;^^i^,^new number thto it is to cairy the old one with them..." 
- Record.- KeeMng Problem^ > ^ \ - ' . v^^^r- ► • \ 

• i-^ prpb^ems outlined above mean that the Service 16 forced toi practice 

criBig ji^diciJie/r^a^^ the patient's chief complaint at the. moment. Thus, 

facility with a cut on his wrilt, the attending physi- 
-,ciai^ vi^l^'^iJi, all likelihood giveltxia a tetanus shot, place k bandage on the cut and 
teil'ltim' to come back ijoi' a f ew days if hris not feeling better. The doctc^r will not 
learn thkt-^he psrtlent is a diabetic*, and is past due W a ref ill on^his medications, 
'that he may have a chCronic heart condition, or that he mS^^ve a history of suicide 
attempts, which wouid certainly give a special significance to the cut on hip wrist. 

While therejhave been attempts to "begin multiphasic screening programs', they 
have been: abandoned for lack of. resources. According to'.one JHS officii, "You spend * 
a lot tjf time (with miatiphasic screening) seeing healthy people which ^would be* better 
used dealing with' illness." \ - , ^ * * , ' ^ 

>^ Although much health data^may have been collected on each patient by various 
healt^ p^fessionals, the patient record may be scattered in the various health -faci- 
lities he or she ' has visited^ 6r it may have been' colleQted byf a social worker or sani- 
^^i^aa'^arid there is no syatem for making it available.to the doctor. No integrated set 
9^,'^^ exists for each patient, and thus each provi4er of health care must treat the 
^^a^i^htNjfith the benefit of oiily that data whicii he or she alone hag collected: 
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^ The problem of malntainihg useful medical records is farther complicated by the 
language barrier. In the Pajpago Indian, tribe , for instance, 65^ of the Indians do not 
speak English and it is difficult :for staff inembers "K^, elicit meaningful health infor- 
mation from the patients.-. This problem is furtheir, exacerbated by the fact that with 
the end of the Vietnam War, fdVeign doctors have largely, replaced those doctors who 
served in lieu of the draft. While many Indians who do not sp^ak English can under- 
stand basi^ English, they find it impossible to comprehend the Phillippine East Indian 
♦ <Jr Pakistani doctor, whose own accent or mastery \t English is sometimes shaky* 

CoDputerizatlpn Of Records 

All of these considerations led the IHS to turn to computerization projects for 
some possible solutions to its record-keeping problems* Since 1968, IHS has pursued 
two approaches to computerization. The first of these was the implementation of an 
automated system in Albuquerque, New Mexico, designed to assist management decision- 
making at all levels of the IHS program. The fundamental output of this ^ysten is 
batch-processed js-e ports that focus^ on over-rail statistics of facility utilization, t in- 
ventory personnel and the nature of services provided (immunizations, dental services, 
atQ:) to various Service Units within the Indian Health Services.' These off-line re- 

^ Dorts are used, by IKC directors in the field and by IHS officials' in 'Washington to help 

•0 in planfiing budgets and deployment of resources. ^ 

! ^ The second approach, on which we will concentrate, is^ the Health Information 
Service (HIS), established in Tucson. It is a pilot project which creates integrated*, 
on-line health records on the 10-12,000 Papago Indiains in Southern Arizona who are 
sei;ved by the Sells Service Unit of the Indian Health Service. 

^. J The Se^lls 'Service Unit consists of an integrated health care team of physicians, 
public health nurses, sanitarians, social workers, mental health workers, and includes^ 

^ *oorrtract"healt)i services as well as the tribal health program. 

The.^area that the Sells Unit serves is characteristic of the reservation x:ondi- 
'tions already described'. The main Papago reservation is as large as the State of Con- 
necticut, with only 6',00</^people living on it in fifty smcai, scattered villages, with 
few telephones and fewer roads. An a.dditional five 'to seven thousand people live near* 
the reservation, or on the nearby San Xavier reservation. The Sells Unit has a 50-bed 
hospital located at Sells in which outpatient clinics are also"" held. There .is* an out- 
patient ^clinic at Santa Roaa and another one at San Xavier. • In addition, intermittent 
field clinics are heM in various locations such as church building^ one or tvo"^alf 
days a week. There are major areas withx)ut electricity and- running water. About 655^ 
of the 'Houses are substandard.^ " ' . • 

. ^ th^ main function of the computer is to provide health professionals with a 
dOnplete medical summary on each patient, which can be retrieved every •time the ..patient 
visits any* of the clinics, outpatient stations or the hospital ^in J:he, Sells Unit. 
Health, professionals are given an encounter form on which to write down patient infor- 
mation. I'his information is fed into the computer and can. be retrieved instantly any 
t^e the patient visits any facility again. The filling out of the eijcounter ^orm it- 

,^s§l^„has assisted in more systematip record keeping. According to Dr. Rice Leach, Di- 
rector of the Sells Unit: ",!Phe encounter form orovldes a terrific reminder to doctors 



to write down what they have been taught to write down since the first day of medical ' 
school.. .We know a lot of things we are supposed to write down, but if the reminder is. 
not there in front of/^^, it slips your mind." 
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• The on-line patient records are made available through- remote Winter terminals 
which are linked to the cotoputer,.by telephone lines and are looated at eaph of the 
health ^facilities. Field personnel are equipped- with portable "lenni^l dev.ices which ' 
can pperate dver any'standard telephone headset. ^ ' " ' ' 

She medical summary provides the health/care te^ member with^ a brief , multi- 
disciplinary health profile on each patient. The computer genera'tes'tfie summary within 
a' -few seconds o:P receiving a. request *frbm ^one of the remote tenninal locatipii^ The 
summary includes all inforittion 'collected- duririg" recent patient encoun*^^Calthough ' 
It takes about. five days to enter new materials, " so that patien-fe infomation gathered 
during a visit within th| five dajra -past might not be included. 

; ' The data 'in- the medical sumigary include^: measurements; active and iaactive pro- 
bl^s;. active medications; inpatient, outpatieJt and field encounters with diagnoses 
and a health status surveillance -component which includes iiinunizations , skin tests, 
• laboratory tests, ^C-^ays and specia^l examinations and histoj-ies. -All of these items 
ar« designed to^ permit the early detection of treatable- health problems; to assist in 
the 2*ientification of individuals who are sfj^ceptible to specific health problems; and 
to provide the foundation for an improved, patieat follow-up s/stem. 

The- most iinportant feature of.the medical summary ds its problecr .orientation. 
The problea list is iicluded as part of the medical summary and made available to-pro- 
viders of health care. The problems included may.be medical, emotional, social, Wi- ' 
ronmental or ^educational The list allows members of the health care team to treat 
each jja^lent in the context of all c^ his or her.Jie^th-rSlated prgblfems, rather than " 
.trea^ng just the current problem.'" Health team members make additions deletions and 
modifications to the problem list by completing standard. data, collection forms. The 
data stored tor each problem includes a system assigned problem number, problem code," 
problem narrative, dates-of entry and change of status, the facility at whi^h the pro- 
blem tes entei-ed and identification of the 'health professional entering each problem. 

Included in the medical .summary , and available at each en~Bounter witfi the pa- 
tient, is an up-to-date list of all procedures .and tests that are past due or are sched- 
uled within the^next twelve months. This, permits the physician take advantage of a' 
complaint visit to perform much-needed preventive maintenance. 

The computer provide access 'to all data of a given type (e.g. all diagnoses, 
medications or operations) for a given patient. The response time, for' such retrievals 
is generally between fif;teen and thirty seconds. 

Special retrievals provide , other ^ more complex kinds 'of information. The TB ' 
contact status repbrt, 'for example, provides a listing of all identified contacts of 
an .active TB patient, and for each, the date and results of the contact's last skin 
test, date and fesiats.of the latest chest X-ray and current' prophylactic medication . 
status. ~ . " \ ' • ' 

In adtitipn to on-line retrieval of individual medical records, the Tucson 
Health Information System is able to retrieve, data for management and planniiig, for 
epidemiology and.resea«i« It can respond to a Request like: "How many cases of these 
SIX diseases ha«re been diagnosed among the residents of any of these eight villages, 
-but I want only diagnoses made beWen April. and September .of .4 970- for/female chijdrefi 
between the ages of eight and twelve." 
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Thes^ o^f-line records, are printed on high speed equipment at the computer cen- 
ter and delivered to the consumer ^ courier. Among the scores of reports generated in 
this way are the fqllQwing: weekly listings of scheduled encounters for^each physician 
and^ public health nurse; weekly listings for each public health nurse of all patients 
who have had recent clinic visits in each Public Health Nurse area; monthly reports for 
sanitarians of the incidence of infections and_parasitic diseases in a designated com- 
munity f various population suirtoiaries by district, community age group, sex, etc.; in- 
cidence of disease reports; facility utilization reports by commjinities , ag^ groups and 
time periods; reports of all, childre^i whose height, weight, .or head circumference meas- 
urements exceed specified percentile values from standard curves; special reports on 
accidents, family planning visits^ patients t)n selected Dipdications , patient disposi- 
tion, and other miscellaneous reports. 

In addition to the above, the computer can. produce reports on a .speci'f ic disease, 
with its demographic and geographic parameters, to support specific corrective programs. 
Alnong these have been reports on: malnutrition and iron deficiency anemia; diabetes; . 
•amejDiasis and dysentery; identification of deaf and blind children; identification of 
attempted suicides. . . ' i 

Citizen Ri^ts Issues * * 

' * , The most important right of privacy for most Indiaiis is the protection of tribal 
(community) values and pisocedures from- hostile surveillance or regulation by outside 
authorities whether the Bureau of i^ian Affairs, local governments, or the Indian^ 
Health Service. Within the tightly-kn^. reservation li^e, much like older small-town 
communities in colonial America, littli^^mdividual privacy is asserted against fellow 
tribe members. But privacy is claimed strongly when outsiders control the education, 
social behavior, employment patterns, br health care of Indians. Conceptions of indi- 
vidual privacy rights against government i^ the Bill of Rights framewoA, are also a 
matter of concern to mgmy Inffiai^, ^fndee^, not only were such fights of individual 
privacy included among those rights ,^soug^t by Indian leaders to be included against 
tribal government Violation in they Indian ^ivil Rights Act of 1 968 but recent tribal 
constitutions (such as ^the Blackfefet tijibe) specifically guarantee the right of per- 
eonal privacy. ' ^ / 

The result of these speci/al aspects of Indian culture is that patients in the 
IHS system have no^- only individual yconcerns over matters of informed consent, improper 
revelation of embarrassing "comVtioAs , and the like but also special concerns, about 
^ invasion of trfbal religious , 'and group mord^. ^IHS officials have generally i>een sensi- 
tive to these concerns , but /the OyVerall citizen rights policies of IKS have — until 
recently — f ollcywed about Ahe sAme line as other medical institutions in American so- 
ciety, governmental or private. 

When the Healthy iMorm^ion Service computerization program became operative in 
1969, the Papago Indiana. did not have an Indian Health , Board . The Board, called the 
Executive Health Staff /was hot ci:eated until 1972. Therefore,- the IHS staff dealt di- 
rectly with, the Papagc/ Tribal Council. They conferred with the Council about the com- 
puterization program, the" LHS Office of Development had in mind, explaining "the infor- 
jnation that would h6 mader available ancT the abilitjr of the program to maintain the con- 
fidentiality of all parVs of it." "No matter how long it took," C'hadwick recalled, 
"we waited until )xhe l/dians* fully .comprehended the computer and then requested that it 



be -used*" IHS off icials t^iso allayed^ fears that computerized records might dictate cul 
tarally unacceptable medical procedures, Dr, Le^ch states: "If the computer tells me 
that an 85 year old lady needs a very personal examination^ and she doesnn want it, 
she doesn't get i-t unless it ife a life-threateaing. or urgent situation. 1^e don't treat 
the computer^.We threat the patient," • * , ' 

lA 1972, when the Papago Tribal Council authorizred the establishment of the- Ex- 
ecutive Health' Staff to act on behalf of the tribe in initiating, coordinating, adminir 
stering and implementing tribal health program, the IHS made its presentations about 
• health operations, computerized ancL^manual, to thiis groij^. 

According to eftadwick, the Indians residing on the Papago Reservation k^ov "all 
there is that it is possible for tljam to consume" about the Health Information System, 
The Health Executive Staff is ^periodically briefed by IHS officials in Tucson about the 
system's operations and xhe Papagos are then informed of the main points by. word of ^ 
moirth, . . * ' ' ' , 

1. Patient Access \ 

Prior to^ passage of the Federal Privacy Act of 1974, policies on patient acde^ 
to medical record? and confidentiality were governed by the Indian ileal th Manual, Chap- 
ter 3-Health Records, -This 90-page chapter, distributed ft) all Servip^ Units and ^ 
Area offices, elaborately detailed every aspect of medical reebrd keepii;ig in the Serv- 
ice. Its policy on patient access was:. 

"At no- •time should the patient or the patient's family be permittee! to review 
the health record. The patient should be referre;d to the Service Unit ^Director, who, 
Wder proper and appropriate circumstances, ,may provide some information to the( 
, patient," • - ^ ^ ' \ ' 

The manual adopts the standard medical position that the record is the j^operty 
of the facility and the IHS, ^ ^ ' ' . ^ 

^ ^ ^ What the^actual t)ractice was is not easy to determined On the one hand, E.S, ' 
Rabeau, a senior IHS official, reported that patients were generally permitted to see 
a copy of their records "*^s a matter of course," On Ihe other hand., Mozart Spedtor, 
Director of the Office of Program Statistics of IHS, and Howard Waldei:man c* the PHS 
General Counsel's Office stated that a patient who "pressed hard enough" could usually 
see his or her record, 

HEW regulations implementing the Privacy Act provide that "Any individual may 
i^equest Sotification of or access^ to a\edical record pertaining to Him,'> The individ- 
ual is t9 be- gTven direct access "if the responsib^^s official determines that direct . 
access is' not likely to ^have an adverse effect on the subject individual^," If this is 
the 'determination, the medical record will be sent. tQ a "designated rej>resentative" 
of the individual, "a physician, other health professional,, or other responsible indi- 
vidual," Such person is then allowed "to review the record" and mal^e the decision* 
wh^ether to reveal "its contents" to the indj)vidual.' ^ ' ^ 

TliLi^ new access- policy ha? h^en de^ribed in posters displayed in IHS clinics, 
though access is not mentJ.oned in/the "Statement for Maintenance of Health Recordb" 
that IHS now gives each patientAo sigh when obtaining information from him 6r' her. 
^Thip statement will be'discussed later under "Confidentiality"), As of late\975, 
IHS officials report, most access requests have been from IHS .employees wishingXto see 
their per^spnnel records. Reports were not yet in as to patient access requests ,'\ 
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There have been complaints 'from some regional personnel that they are not quali- 
fied^ t 6 decide whether giving a patient a record wodld be detrimental, and the Service 
Unit Director^ hav^ been authorizeci to seek assistance from. a physician when necessary, 
5ome problems have arisen because the regulations are designed primarily for situations 
in which the government is not the primary care provider. For example, there is usual- 
ly no other physician, outside the IHS that can review a patient's record if ther^ is 
an access question. 

Should errors be found in patient records, IHS has taken the position that it. 
will adti corrections to the record rather thsin Wipe ou1> the old information tSat'iSr.. 
there, .The same policy l;as been adopted by th^e National Institutes of Health, \ 
2, Confidentiality \ I ' i m 

Prior to the Privacy Act, regulations for protecting the confidentiality of pa- 
tient informat-ion and records were listed in 20 cldfeely typed pages of the IHS Manual's 
Chapter on Records. In genej^^al, records ^could shaded without patient consent among 
IHS health professionals for the purpose of providing direct patient care; for statisti- 
cal research purposes; within the Public Health Service for audits by the General Ac- . 
counting Cffice; and in cases where the U,S. Attorney is engaged in defending the PHS 
against a patient's olaim. Law enforcement agencies such as the F^I , and local 'and 
tribal police could be provided with non-confidential identification information (name, 
age, height, weight, color of hair, etc.] without patient consent. Release of confi- 
dential medical ihf orma^t,ipn to law enforcement agencies required signed patient author- 
ization. ^ - ' " ' 

^ ^ Kelease pf patj^ent information to contract physicians and hospitals, social agen- 
cies, insurance companies, employers, attorneys and tribal authorities required 'signed 
patient authorization. Release of patient inform^ion for research outside the Public 
Health Service was not permitted. Patient reccrrds were ^released when subpoenaed, with 
the patient required to be notified promptly. 

In the pa*st, IHS received qiiite a 'few i*BTiuests for patient information from 
prospective employers and from government agencies* One government request x:ame from 
an assistant U.S. Attorney, who demanded that IH3 officials provide him with records of 
all Indian women under the age of 18 who had contracted ve^;iereal disease. He wanted to 
learn from these women the identities of the men who had infected them and prosecute 
them for statutoi^ rape. Despite his pressure on, the Justice Department aAd on HEW, 
the IHS refused his request. "We're not policem'en, and we're not in the tracking 
business," observed Sidney Edelman, Assistanl^eneral Counsel of the Public Health 
Service. ♦ . 

Another request ca^e from the U,S. General Accounting Office (GAO)* a few years' 
ago. A GAG officia]^ asked IHS for 300 medical histories»of Indian women who. had been'* 
treated^ for gonorrKea along with their names and current eiddresses. He said that a& *^ 
part of an "environmental study" GAO wanted to visit these;women and investigate water, 
soil, and a^r conditions in their home areas. The IHS official refused, saying that - . 
such epidemiological studies had nothing to do with the auditing and fiscal functions 
Congress had assigned^ to 0AO, and there was no justification for supplying the case 
histories. This set off a series of istrong demands by higher and higher officials at 
GAO, Finally, the IHS official sat down with a top GAO executive and patiently ex- 
plained the problem to him, "If your wif^ ,had contracted gonorrhea and had been treat-r 
ed at a faderal hospital he asked, "would you want some federal official coming to 

^ . 182 ' 



FRir 



^ ' '203 



the door and announcing that he wanted to talk about how sfie got it?" The GAO execu- 
- • tive <3aw the, point, apologized, and the incident was closed. 
:\r . ' . 2mployer -requests for medical information have been referred back to the patient 
for specific release authorization. Dr.. Leach states tbat "when an employer comes di- 
rectiy'to^me for information 1 without patient authoriaalfion) , I'send him home," 

Complaints about breaches of confidentiality seem to occur mostly abouV people 
who have jobs thkt give them access to medical recoWs who are also residents of the' 
community. According to a doctor at the IH3 hospital serving the Apache tribe: "This r 
is a small town and people tend tb gossip about information they see." The doctor con- 
fessed that he hims^f had used patient medical records in .a 'non-professional way. He 
looked into medical records when he ^d his wife were liqking for a new babysitter be- 
cause they hacLieen "burned'' by a babysitter previously ,^ and they wanted* to check on 
the candidates. Another incident related by the doctor concerned someone whb applied 
for a job at the hospital who^had been an emergency room patient. The doctor toH the 
•nurse to look in the individual's chart, and after doing so, 'the nurse said "eFie didn't 
want to hire him." > . 

. All of the above 'incidents refer to the manual records which are kept in addi- 
tion' to the computerized records. When the HIS system was about, to become operational, 
Papago Indian leaders expressed ^the fear that -they would be "put on public display if 
their medical records were computerized/" °IHS' officials convinced the Indians tha.t con- 
,fidentiality would be^ better preserved under an automated system than under ^a manual 
one. It's far safer 'to have that. sensitive information locked in a computer, 'than to 
have a record just, lying aroipd for anyone to^see," an IH3 official explained to tl?e 
Indian representatives. " , 4 

,In his 1972 testimony before the JJEW Advisory Committee on Automated Personal ♦ 
Data Systems, Dr. Leach explained the security measures .taken to protect computerized 
information, "The files are locked and you need a- lock number to get a meiica; sukna- 
*ry." The system protects against an individual conducting a fishing, expedition for 
other information such as "Gee, I -wonder if Cousin Charlie has got his problems listed;" 

. In addition, the system is d^^jveloping a 'unique- internal numbering system whick 
is seen as a further '§ld to preservipg confidentiality. ' The numbering system was not 
developed for the pri^aary purpose of insu^-in^ confidentiality, but to deal with .the ^ 
factahat only 2(>/^ of 1;he Papagos have Social Security numbers, and many gf these, may 
have more than one. ^In additpn, Papagos, like most Indians, have^'°an Indian name, 
^ which they do not ^hare with outsiders, aiid they may have a vdriity ^f English or Span- 
ish names which they don't regard* as important and. so sometimes use one or another of 
them. * The computer will sort out these yarious nam^s against the other idei;itifying in'- 
. formation, to create one record for them all which will assigned a spe9lkl number. 

^After the federal Privacy Act went .into' effect , iij S^ptemb^r of 1975, IHS gave . • 
each patient a coi5y of a "Statement for Maintenance o:^ Health Records," *This explained^ 
the statutory authority under which IHS maintained such records. Then the form ex- 
plains: ' ' * x ^ 

Theojjurpose for requesting perscmal information is to maintain an accu- 
• . rate .record of your medical care. This reco2?d contains what you tell 
\ the Health Care Provider, is wrq^ig with you or how you feel. The health 

\ care providers write into your record your family and personal history 

\ and the results 'of your physical examiiiatien. They also record the re- 

sults of all tests, ^medications, treatments, or surgical procedures vou 
receive in Indian Health Service facilities. 
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^With few exceptions Jadian H.eaith Service personnel will riot tell anyone 
* \ wh^'t is in your record without your written permission. Copies of your^ 
record must 'released to the State and federal courts i^ we are ordered 
to do so. Information from your rec,ord is used to re^'ort medical condi- 
tions 'to Federal , State and local agencies, including schools, Tribal y 
- groups, and health departments if they, need to know the information. It 
\ * may be used to send needed information if you are referred outside the 
. V Indian Health for .additional care, to evaluate the care you receive, to , re- 

determine professional certification and hospi^tal accreditation, to pub- 
lish statistical reports, and to plan special health programs, 

' • , You may cjioose not to answer the questions if you so desire. However, 
this could have a direct impact on the quality of care you receive. • 
Therefore, it is in' your best interest to provide complete and correct 
* information so that we will be able to carry out our responsibly ty of -^^ ^ 
providing you pi*oper health care. 

Following this is the statement "I Understand Why The Information is Asked ^arid 
the Purposes and Uses of This Information," with, a place for the patient's signature 
and the date. The HIS computer has been reprogrammed so that it shows whether a pa- ^ 
tient has seen and signed the Pr,ivacy Act statements. ' ,^ 

Publio health officials and IHS officials in the field have already spent con- 
siderable time and money on •implementing the 1974 Privacy Act, including a week-long 
training session^n Washington' an^ meetings attended by Indian groups and ^S 

persoimel. AltiiOugh IHS p^op'l^i JC^%1 that the general idea of the Act is a good one, 
they complaiE^ ^at not enough thought was gi'^en to the special complexities of medical 
records, and that some of the requirements are burdensome and conf-using. 

The most burdensome requirement, they feel, is the drsp^osure log in which an 
entry must be made every time p^^ient inforination is disclosed, stating the date, nature 
and purposes of the disclosure, as well as the name and address, of the recipient. 
James McArthur, the Area Privacy Coordinator at Sells points out that there' is a total 
community program that carries health injo the^field, .It is common for IHS personnel 
to consult with county nursesV^and school health workers, and every instance of this 
sharing is required to be noted. . IHG public health nurses find the requirement burden- 
some too, and practices such as reporting positive strep throat cultures to school 
nurses may have to be curtailed unless additional personnel are hired, according to 
Spector and ^alderman. In addition, IHS. has had difficulty in obtaining from the 
Socp.al Secu^^ity Aoministration ijaformation it obtained previously to determine eligi- 
bility of Indians for benefits under othfer jgovernment programs. 

Future Of The Oompdter In The Indian Health Service 

The computerized HIS system is regarded with entJjusiasm throughout IHS. Mr. 
Chadwick calls it the "leading" comiputerrbased health information of its kind. The 
Rational Ini^^n Board of Health voted* unanimously to adopt HIS throughout the Service* 
Area directors throughout the system are also favorable and the system has won almost 
universal acceptance from the physicians anct jpatlents aigong the Papagos. "Doctors at 
Papago scream i^ the compute? is shut down for 21 hour?," Mrv Chadwick observed. ~ 
A .brief experj^ntal program in Alaska was also enthusiastically received by 
officials there. Using a telecommunications satellite that was located there for a 
period, it was possible to conduct two-way television ai^ long distance specialist^ 
* consultations. The Retrieval possibilities Were, not as/great as in the Sells Unit, 

but , officials ±n Alaska would like to see the project continued. Throughout the IHS, ^ 
• officials are working on computer possibilities. In the Billings area,, the Chief , 



ERIC 



^^-•■'t • " ■ ' -205 



MQddcal Officer is chairing a committee ^o determine" their computer requirements. Spe-, 
cial HIS advisory consjfittees are trying to devplo^ special compu1>erized high-»risk pro- 
grams (aic ohol ism, suicide attempts, maternal and child health, etc.) t^ improve IHS 
ability to allocate resources. Other' plans .call for the improvement of data entry 
through the use oi video display stations at field* sites, and the develbpment Qf.^re- 
porting systems for so.cial service workers, mental health workers and other paramedi- 
cal groups . ^ \ ' " , - 

But in s^)ite of all these dreams, it is unlikely that the Sells Una^ will be ex- 
panded to include more functions, or that ^ other linits and areas will be giv^nVcomputers 
An .indication of that unlikelihood is in 522, the bill to expahd the. services and" 
facilities of the Indian Health Service. The bill proposes to expand the Serv'lce's 
budget substantially, including a separate large ctJhstructiori budget to build new . 

hospitals and other facilities over the next five yeai%, and making provision for fund- 

I 

ing health services ^to urban Indians*. . H:iere is no budget item in this bill for an ex- 
panded Health ^Information's tern. According .to Chadwick, a HIS system througi^put the 
Indian Health Service would cost between fiv6 and seven minion dollars," and it would 
be "a hell of a good investment." But Congressional 'supporters of IHS did not write 
in funds fpr such computer expansion. 

Observations ' . ^ ' , * ^ « 

The HIS experiment "with the Papagos Indi^is has indeed proved that It can create 
integrated, instantly rej;rievable medical reqords that soft-e the formidable problems of 
vast spaces, pofin roads, ,and telephone coWiunications^^EEe" migratory nature of the pop- 
ulation and the language barrier. It is a system ijiat has strong support from physi- • 
cians, nurses, and managers using it. Iti^as a2:so proye({ that the system can identify 
and docuiiieht the most f)ressing health needs^^-tJx^ the Indian people it' serves. 

But these computer capabilijiies merely emphasize the betweenj^ociety *s abil- 
ity to record dnd diagnose its ailments ajnd its inability to treat them. Unti^^the 
Papagos — along with the rest of the I;idian population iR the United St&tes-^can be as- 
sured of an adequate liealth care delivey system, including hospitals at least on a 
par with those available to the rest of the population, adequate numbers of health care 

personnel, adequate funding to combat their special health needs anU to improve sanita- 
tion, nutJ'itioTi, housing and other environmental factors that jeopardize health, Indian 

^health will continue to be in crises. In this crisis, a computeirized medical records 
sypteta can only be regarded as luxury. If the needs outlined were to .be fulfilled, 
however, then the HIS system pioneered among the Papagos could serve as the central 
force for making the delivery of medical care effective. * 

As far as citizen rights are concerned, 'IHS now has a new set ^f polix^JLes de- 
fined by the Federal Privacy Act. There would seem to be no reason why the computer- 
ized system in, IHS wiil' have any greater difficulty in complying than'^the manual re- . 
co:gjd systems. How the new rules a^ to confidentiality and patient access will work in 
practice will be examined in 1976-77 by the federal Privacy Protection ^tudy Commission 
and by Congressional committees overseeing the o^fctions of the Act. "^This will pro- 
vide some important d^ta about the advantaged, djladvantages , and costs of the new 
rights set by the Federal Act,, and how, the Indian population regards these measures. 
IHS officials intejrview^d in earljr 1976 said it would be "several years before all the 
contingencies are clarified." Some of the most important of these problems will be 
discussed in our final chapter. , ■ . 
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CHAPTER 9. THE MULTI -STATE INFOR h^A'TIO N /^YSTEM 

/ 

; The Vulfi-State Information System (MSIS),is automated information system 
^ for mental patients • records, desired to serve botn administrative and research 
purposes for paciicipating institutions throughout /ihe U,S, TJ^ owner and manager 
of the central computer, the Information Sciences iuivision of Rockland Research 
Institute, a state facility in <, Orange burg, i\ew York, does not deliver primsiry care 
or pass on any questipns of eligibility ^or claims/ of pa'tients; its role is limited to 
developing: cojriputerized forms, administering the /data base and data communications, 
and sponsoring: research by the Institute 's r'own personnel. In our scheme, it is 
primarily a :!one 3 organization as far as its research ftmction is concerned, but it 
could also be considered an extension of the' Zone 1 menta^l health centers that use it, 

and it is precisely the^ hybrid character of.MSIslthat makes it imoortant for our study, 

yzi3 is a system that has invested long deliberation and careful planning to 
assure the confidentiality of patient i^cords, | Psiradoxically, this system has been 
- publicly attacked for posing grave new dangers 
concern of both the desi^ers and the pritics eli 
sensitive nature of psychiatric inf ormation.^but 
a new type of andividually-identified. patient record system - a 'multi-state databank 
with each state having different istatutes^'j practices and perceptions of the degree, 
of confidentiality required for medical record-keeping, " t ' 

Background " ^ • * . 

The genesis of MSIS was a demonstration at the Fourth Woi'ld Corlgress of 
Psychia^try in I966 by ^the Informaition Sciences Division of the Rockland Research ^ 
Institute on the uses of computers in 'psychiatry. At the demonstration, clinical data! 
collected^ in checlflist form on^a. psychiatric questionnaire, were converted by computer 
3nto read ab^^e 3 grt'rative reports. To develop this idea of producing narratives by ♦ 
computer, the U.3, National In'sti^tute of Mental Health invited the Information Sciences 
Division to apply for a development grant, which it obi|ained in 1967, This ws^s an 
$8 million g^ant for*five years, and it was awarded wi^ "the understanding that MSIS 
was *to be a regional system. ' • ♦ ' ^' , ^ 

3y 197^1 six states— Connecticut, Massachusetts, Rhode Island, Vermont, gome 
* -facilities in New York, and One fa^cility in New Jersey, plus the District of Columbia— 
were participating on-line in MSIS, using the central computer at Rockland Research 
institute in Orangeburg, Hew York, Most MSIS user^ aJre state institutions or private ' 
facilities relying on state aaad federal money j these serve largely lower 
, socio-economic patients. But there aire some private voluntary agencies and community 

mental,^ health" centers in MSIS who have middle class patients, as well as a few 

exclusive .psychiatric^clinics with afflu^t patients, 

, In September) * 1975, MSIS had approximate ly 400, 000 patients on file, most / r 
represented by a single episode of admission, treatment and termination, About 45,000 
were invoJ.ved in multiple episodes. At present, MSIS is the largest computer-based 
mental he;alth information system in tJie country, - " o - 
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In 1972, NIMH .funded a. two-year renewal grant of S^2 million for further 
/' develofJmfent of MSIS, This money supported the staff and the central Computer at 
I' Rockland, with each participating state assuming a shai?e^ of fehe' rejst of the operating 
costs. When the federal grant ended, MSIS ' 197^-'?5 operating budget of $550>OOo' 
came entirely from the pairticipating states. The cofet to a participating institution^ 
is $5^00 to process each patient episode from admission to termination', 

• How MSIS Works ' ' ° , • • 

^ ^ The information that MSIS computfers^ is capable of collecting and storing fSflls 
into five categories i • • . 

1, Demographic: Sex, 'birth date, address, marital status, ethnic' * 
group, J religion, household composition. 

Administrative: Legal status, physical location of patient or 
name of treating unit, prior psychiatric service , ^source of 
referral. * > ^ - 

3^ Patient progress: Clinical appraisals of patient's psychiatric 
condition' including mental status^ exajninations, progress reports, 
dia^osis, case history,. • , * - - 

^. Treatment: A record VaQaH^^eatment contacts and a detailed ' 

record of psychotropic drug therapy, * / 

Service rendered: Direct services^ rendered, contac'Ps made, 

indirect serva^s* s(2ch as consultation and community educatiort, ^ 

ancillaLry services such a,s x-ray, laboratory tests and dental 

treatment, * v ^ _ 

While these are the total capabilities of MSIS, the syste^ v^as designed 'so that 
facilities could participate in accordance with their vairying* needs , ' Only two types 
of re-cords ^.are^andatory, THfe first is the Admission form, which must be filled out 
for each patient episode stored in the compute'rl However, even many of the items of 
this form may be omitted at the option of the pairticipating , institution j of its 37 
items, only 6 need to be filled in to create a patient record. The second of the 
mandatory records is the form showing how the patient episode terminated (either a 
Termination form or a Change in^St^*^ form.), ' ■ | 

All othe!r forms available to MSIS usejs are optional. Two of these- optional 
forms of paurticul^r interest in mental health, administration sire the Mental Status • " 
ExaminatioYi Record, which maJces. possible appraisal of- the patient's problems and^ their 
severity? and the Psychiatric AnamnesticlRebord , designed -to record basic casfe history 
data, ' ' ' 

To enter patient records in MSiS, participating institutions bring' their 
completed forms to the riearest MSIS terminal,* Som? hospitals and mental health 
centers have their own terminals; others use terminals located in other facilities or 
in regional or state offices. Most daf^collected from New York State facilities, 
for example, is processed on' the computer of the State Department of Mental Hygiene, 
in Albany, 

Terminal ^communication with the MSIS computer is by or4inary dial-up telephone 
lines. When information is transmitted^o the -computer , it generates a correspondihg 
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report which is sent back to the terjninal and distributed by terminal personnel to 
the appropriate participating facility. When an Admission form is submitted, for 
example, a note reflecting^ the inf or*ination on the form is .Returned to the facility. 
Many reports generated by MSIS are in narrative .f^rm and substitute in part for 
those usually dictated by clinicians, This work is done by batch-processings not 
on-line, since rapi^ response is not peeded for MSIS activity. 

Clinical Uses , ^ • ^ ^ * 

To demonstrate its* record-keeping capabilities, MSIS has prepared a model case 
history for a fictitious patient named Mary Stewart. The information on Ms. Sjtewart 
was taken by clinic personnel and recorded on machine-readable forms, from which the 
computer produced 15 taAular and graphic summaries for her psychiatric records, It^ 
must be kept in mind, that this is an ideal representation of the system's potential^ 
few participating facilities use all of the forms, especially the diagnostic 
suggestion one, although some may provide all of the clinical techniques and 
services illustrated in Ms. Stewart's case. . * \ 

The Admission form establishes the patient's identity, assignment "^0 ward and 
unit, demographic data» appraisal of problems, previous* psychiatric service, .and 
Source of referral. , ?'s. Stewart 's record show» that . she is a 2^-year old secretary 
who lives with her parents. She came to the clinic yolun-tarily , apparently suffering 
from drug intoxication. She had previously received psychiatric care from ^ private 
psychiatris/t and' at a mental health center.* Among he-r recorded problems were 
disturbances in her relations with family and ot|ier people and in job performance, 
as well as suicidal thoughts, depressed iriood, social withdrawal," delusions, 
hallucinations, sexual problems and incoherent speech. The diagnosis was drug or 
poison • intoxication and the -overall severity of he^ condition was judged slight. 

Ms. Stewart then underwent complete psychiatric, psychplogicfil and social 
evaluation at the clinic. Basic case history data was recorded on the Psychiatric 
Anamnestic Record form, and a narrative report was produced from this data by thel 
computer. After verification of tW report's contents, usually Indicated by the ^ 
physician's signature, the narrative may. be placed in the. patient 's chart. The - 
information for Ms. Stewart's report was .olx^ained from a physician, ^the patient, and 
a family member, and its reliability rated asF<^"good". 

Tfie onset of her current condition, which developed gradually and has- been^ 
evident for three months, was apparently associated with a mildly s^tressful 
situation involving a drug reaction ahd family pjrqblems. The patient's ^mother has a 
.history of a mild functional psychietric illnes^j her father , has a history of a 
■severe^unctional illness; she has one sibling who has been at ie^st mildly ill. The 
section on personality traits reports that the'^patient is .inhibited, unable to„rplax, 
emotionally distant, stubborn, suspicious, and gets little pleasure^ out of life. 

The Mental Status Examination Record includes (^tailed information 'about the 
patient's app'earance, general attitiide and behavior, mood, ludgment^ potential for 
suicide^ or violence, insight and attitude toward illness, and overall severity of 
illness. ./ ^ . 
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Based on jthe^ infortnation in these two forms, the computer can produce a 
^^sugeested diagnosis. This, howevef , is solely a tool for the clinician and does not 

become a .part of the patient's record. >or Nancy ^Stewart , the computer gave two mpst 
^ li-^ely diagnoses I schizophrenia, paranoid type, and drug dependence, hallucinogens. 
^^^jA^C'l^ study at ^SJS has shown a high correlation ^et^en the computerized 
dii^nosis and the doctor's diagnosis, but as already noted, few MSIS participants 
use this procedure today. 

During: the course of Nancy Stewart's outpatient therapy, her condition 
deteriorated, and she^ was tran^erred to inpatient status. Her continued delusional 
thinkinr and suspiciousness led to the conclusion that she was schizophrenic; drug, 
ffrouj) and individual therapy were prescribed and monitored. . 

Her progress was monitored on the Periodic Evaluation Record, which noted 
persecutory delusions, good physical health, and her activities, which included 
■ visitors and attending; organized patient groups. Afjer three months, Ms. Stewart 
had improved enoug-h to be returned to outpatient status, a fact recorded on a Change 
in Status form. The Periodic Evaluation Record-Community Version showed that, during 
her outpatient therapy she was still slightly suspicious and .uncooperative, but that 
her condition was improved. 

Approximately six months after Nsmcy Stewart's initial admission, the episode 
was terminated. Her Termination form^ recorded the final official diagnosis and stated 
that no further care was indicated. 

* VSIS has also automated^a problem-oriented psychiatric record designed to 
introduce clarity in\o psychiatric record-keeping by making th^treatmen^ rationale 
explicit. This was used in Mairy^Stewart 's'^case . The hope is th^ structuring ,the 
record^ around a core problem list arid keying all treatment and patient progr^ess data 
to problems will foster increased use of the chairt as a communicatioh medium and as a 
tool for utilization review and program evaluation. I.t is a.till regarded 
experimental, however, and is seldom used by MSIS pairticipants. . 

N"^. Stewart's fictitious case study illustrates the role that automation could 
play m every stage of keeping individual psychiatric records. Howej/er automated 
clinical records aire bein^^ used fat less frequently in PJSIS than administrative and 
research computer functions. There are several reasons/for this. Doctors, according 
to Dr. Eu^^ene H. Laska, Director of the Information Sciences Divisior\, "are not 
entirely enthusiastic about ^record-keeping in any shape, f orm 'or f ashion , " .and he ' 
knows of very few psychiatrists V/ho rely heavily on 'patient history recorda, whether 
rnanual or computerized. Generally, psychiatrists are skeptical of conclusions drawn 
by an ^unknown author of a patient history or of a diagnosis found in the record. 
They prefer .to collect and evaluate the pej?sonal data themselves. An important 
exception to this is the use of drug ^umm'airy outputs, which enable a doctor to find 
out which drugs have been tried and in ^ what dosages, and whether or not they; have been 
successful. ' ^ * ^ 

y 

Dr. Laska notes, however, that younger doctors at Rockland Psychiatric Center 
are pro-MSiS because \t. takes care of many of their record-keeping chores and allows 
for useful retrievals. They are not hostile to computerized diagnostic suggestions, 
and use of the Mental Status Examination Record by doctors there is increasing. But 

.^^ :^ -'^ V. . 
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Dr* Laska adds, he does not really know "if the outputs are being read." 

A-Tthe Connecticut Mental Healih Renter — which MSIS officials suggested for a 
field study because^ it is a heavy j^SIS;^ user—MSIS was .planned oftdy as an administrative, 
aid, and not for clinical pur^ose^, ^ The Connecticut Mental Health Center at New Haven 

^ is a joint venture of the State arfd Yale University, it is largely an outpatient 

facility with only 45-50 inpatient beds. The Mental Status Examination Record is used 
only for utilization reviews on the inpatient wards. Clinicians .prefer to use the 
notes they dictate and that are put into the patient's chart; they believe that the 

. r^SIS forms are "not rich enough for them," " ■ - ^ i . 

Research Uses 

Aside from physicians* instiictive preference for ^their own notes, and their 
traditional dislike of record^keeping, a less expi^cii element may irifluence the 
greater research and administrative use of MSIS capabilities. Along with other mental 
health information systems , N'SIS was originally supported by jresearch-granting ^ 
ae-ercie^, as a research tool. The grant receivers tend to be more responsive to the 
research-granting agencies than to the service-providing agencies. 

The research capability of MSIS has been impressive. For example, researchers 
have investigated drug data in an effort t<| link variables from an individual'^s ^ 
back^-round to drug response. A study using data on 9-10,.000 patients at Rockland 
Psychiatric Center examined the relationships amOng drug prescriptions, diagnoses, 
and other variables. The study showed that in many cases, the' optimal drugs were hot 
being prescribed. »^ , » 

A research team directed by Dr. Carole Siegal, a mathematician at the 
Information Sciences Division, recently developed a way of evaluating the effectiveness 
of community health center procedures. The study^howed that there were differential 
service patters for various age, sex and ethnic ^oupings and raised questions as to 
the ,iust if ications for this. 

Research and proe:ram evaluation activities using MSIS data are particularly 
strong at the Connecticut Mental Health Center, whose staff members include professors 
- or instructors at Yale. According: to Michael Levine, Chi#^ of StatistJ.cs and Data • 
Processing, many steiff memT^ers axe engaged entirely in research. More than forty 
papers published by the staff of this Center have been based on or have used MSIS 
data. - ^ " - ^ 

* Researchers at the Information Sciences Division, as a follow-up to ^tutfies 

suggesting that Reserpine therapy for hyper*tension is assoaUted with breast cancer, 
have started a study of this relationship using the prescription records of 
Rockland patients on the MSIS 'file. The study is particularly relevant in a 
psychiatric center because Reserpii^ was routinely pjrescribed as a psych^ropic 
drug. 

Admin'istraifive Uses 

The. Greatest use to which MSIS is put is still for administrative records and 
reports. To serve these needs, MSIS has two basic retrieval mechanism^. GALS 
(Generalized Alphabetic Listor) is a language used to generate H^itr^of gartien.ts who 
satisfy criteria specified by a user; for example, a list of all male patients in 
^ residence between the ages of 18 and 25 with a diagno;5is of schizophrenia, paranoid 
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type. STARGEN (Statistical Report Generator) is a language used to produce * 
statistical cross tabulations: For example, a cross tabulation of all patients in a 
particular facility eligible for Medicaid by age, sex and diagnosis. 

Usinfi: these two retrieval systems, MSIS has developed a broad variety of lists 
tailored^to specific information needs j Lists of patients whose legal commitments are 
due to expire I patients who are due for physical examinations or other tests j patients 
who are receiving more than two psychotropic medications j all patients in a given 
building under the supervision of a psLTticulair doctor with their ac1>ive drug 
prescriptions. (The last' list is routinely used by nurses to prepaire medipation cup 
cards and by physicians to review the curren^regimes of the^r patients.) At .one 
participating: facility^ this routine list indicated imuSually iairge amounts of a 
crsleep-inducing ^ru^ were being used. Checking reveailed that one night attendant was 
Qver-medicating the patients so that they wbuld not disturb him during the, night. 

MSIS allows participating facilities to comply easily with 'NIMH requiremen-f s for 
an annual report on patients in residence. To meet this need, MSIS developed several 
NIMH tal5les, as well as^ other tables be used to satisfy state reporting 
requirements. • 

As users become aware of the capa^bilities for statistical reporting, the 
requests for reports both increase and become more diversified. Today, about half of 
the total computer time is spen4: on such retrievals: Local alcoholism and other 
clinics now get lists of patients who fail to return for follow-up visits. Rockland 
County CommunitSVental Health Center periodically requests a list of all patients 
who showed suicioal tendencies ax;d who have not he^ seen for 30 days* 

Mental health service does not generally require on-line retrieval of individual 
records. As Dr. Laska'Tioted', "No one's upset if the computer is down for three hours^" 
This is because most users keep manual records, on their patients and can go to these 
for immediate needs. And except in the emergency .room, decisions need not be made ^ 
instantaneously. They have the time to go t<f the manual records or wait a few hours* 
for a printout.' ~ - — - * ' J^'., 

' But the ease of programming in GALS and STARGEN ^i^oes all^ the system to respond 

to special emergencies. For example, when Rockland Psychiatric Center faCed an - 
employee strike, egiergency plans had to be made to^kfransfer 600 patients together 
facilities. Each transfer facility received a computer list of patients and their 
dru^ regimes so that there would be no interruption in chemOtherai\y • This was done 
in one day, which would have been impossible wlthoulP^the computer. 

Another emergency involved an ex-patient who wis discovered to have amoebic 
dysentery. All the patients who had been in his ward would have to be examined for 
the disease, but many of them had moved els*ewhere and historical lists of 'patient 
location are not kept manifalTy. The ccftnputer retrieved a list of all patients who had 
been in that particular ward at that time plus their current locations. Examination 
qj* these patients revealed several more cases > they were treated, and a possible 
epidemic was averted. 
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*■ At an^MSIS facility in Connecticut, an ex-i)atient had allegedly committed a—' 

murder,, When the. press rejforted that he was a released patient, the Governor 
inquired whether the facility was releasing patients too soon. A statistical report 
was compileci on patient releases that showed the hospital wa^ acting consistently 
<with trends throughout tHe state. ^ 

»The foregoing are only a few of the many exan\ples of MSIS' versatility and 
capabilities. 'J.rjow in its eighth year of operation, MSIS is a stable, proved system, 
which is attracting facilities ' all over thg world to use MSIS forms ^d techniques 
in their own mental health information systems. In this country, facilities in 
Alabama, Nebraskav Hawaii and Tennessee use MSIS software, and the State of „ ^ 
Tennessee processes^ t)ie data for a Georgia facility. Overseas, Israel, Indonesia, 
'Italy, Belgium and Canada— either governmentally or through individual facilities— 
now^use MSIS forms and techniques, 

, ^ I-n addition, there' are several pther advanced computer-bafied mental" health 
information systems in operation, such as the Missouri Department of Mental Hygiene, 
the Walter Reed Army Medical Center in Washington, and the Fort Logan Health Center 
in qenver. There are also regional or national computer networks organized around 
identified records about a single disease or condition, such as- the National 
Arthritis Data Base system created under the National. Arthritis Act oof 197^, There 
is no doubt that the techniques pioneer,ed by MSIS and similar 'single-facility or . J 
multi-state information systems will be used far more widely for mental health and 
other medical .data systems in the coming years, ^ This gives the policies of MSJS >as- 
to citizen rights their special importance, 

(Citizen Rights Issues 

^ ^ Beq^^use MSIS is a pool of patient information drlWi from many health-care centers 
in .many states, and MSIS itself does „not administer carl or adjudicate payment claims, 
several elements of citizen rights discusUd in other profiles are either peripheral 
to or^take on different forms for MSIS, ' . 

^TaJce the issue of patient access^ for example. MSIS has ^n ever been asked^by a - 
patieht to provide his/her record j if it were, it would refer the patierft back to < 
the facility where the^TT^a^nt originates and the original record was genersited, 
?he patient access policies' oiNt he participating facilities run the gamut (very 
'narrow) of similar Jiental health\care facilities, whether the records are kept 
manually^ or conipijjj^rizediil^ Some i(equir> a court order from the patient's attomTy 
to verify that the attorney is reforesenting the patient and^there is "good cause" to 
.provide the record (advice of thai Mental Health Officer at Rockland) ; otjbiers require a- 
subpoena (Connecticut Mental He^A^h Center), although this Center's clinicians are - 
sometimes willing to discuss a patient's record with him without actual pro^riding 
a cpty of it. But in any case, MSIS does not set the standards for patient access ' 
t<(the original records kept in participating facilities, and it believes that 
patient access is "not an i^sxie*** 

The Connecticut Center reports that "patients are asking to se^ their records 
now,** In the spring of 197^, ABC television broadcast a program cailed "The Paper ^ 
Prison, dealing, with a variety of record keeping settings and detailing people's " 
problems in getting access to and corrcTcting their records in schools, police 
departments, the military, and delinquency programs. Following the' program, the I 
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Connecticut Vental Health Center ha^ received about 8 or 9 requests per month from 
patients who want to see the-irr^ records, compared to 1 or 2 requests per month 
previously. No one h as specifically asked for computerized records. When a 
patjpnt requests his records, officials at the Connecticut Center tell him that they 
cannot give him the records unless he obtains a subpoena or arranges this directly 
with his^ clinician. Kany clinicians will share information from the records with 
■the patients Jby reading it to them or discussing i*t: with them, but very few doctors 
affree to show the records to the patient or provide a copy of 'them. According to*- 
r/ichael Levine of the Center, several patients have gone to court over at^cess rights, 
but so far all of them have lost. He' feels that* eventually this situation will . 
change, and when i't does, the nature of the patient record will changei doctors 
will withhold certain information from the record if they know, that the patient may 
read -it. ^ . , ' ^ ' . 

As a 'theoretical matter. Dr. Laska states that MSIS would like to work with its 
user panels and with advisory groups to make the system "a pioneer in affording 
^ patient access." But it is not clear just what this would mean, and he recognizes 

that, any system giv-ing patients access to KS13 files themselves would probably, 
^rlqui^e passage of -new access laws" in the participating states. J 
. The issue of privacy .in the MSIS system, in the sense of what patient 
information i^ collected and recorded, should be examined in light of the flexibility 
fyiSI^ gives pafticipating facilities in deciding what data to store in the WSIS 
- computer. It is worth repeating in this context that only six of the 37 ^ 
informational items, on the Admissions form must be completed to open, a patient record, 
.ami the oniy other form required is a Termination record. , Moreover, participating 
facilities may omit^the patient 's .name and social securi'^y number entire^ly, using a 
unique number or- code as the record key.v Beyond the miniinum^ items, MSIS *does not 
mandate what information is to b^ stored, or provide guidelines about wHat* data 
' collected locally is to be used only at that facility, whether manually or 

comjputerized. The&e practices, vary Yrom state to state and from one participating 
institution to another. Foi* example, Massachusetts^ does not collect and store patient 
, drug abuse inf ori^a^ion, ^d Connecticut does not sto^rre any information on patients* 




criminal records^. 

Sor^ participating Tnltitutions provide chaplains with a list of inpatients of 
, their faith,, so they will know whmn* to visit. One facility gets a last of^Jewish,^ 
patients to whom matzoh will be distributed during Passover, ^ome participating 
states use ethnic and "religious data to insure that thet*e is no discrimination bn 
thApart of service delivery agencies. But again , *what information is colleated *by 
ther participating; facility ^and for what purpose it iSsjfetrieved depends on decisions^ 
made by the f acilit^r -^ot by MSIS, apd these decisions would likely* be made the 
same way whether the records were kept manually or computerized, whether stored 
locally or* centrally. So the issue of privacy, in the context of MSIS, is 
i/iteresting^ bu-t not central. / . ^ 

What is central is the confidentiality of the records that^^^SIS stores. "The 
mere fafct that a patient has been hospitalized in a psychiatric institution""must be 
kept confidential," Dr. Laska be'lieves. How to assure this is ithe^direct 
responsibility of MSIS,^and its msmagers have done considerable thinking- "agonizing" 
would not be too strong a term - about how to create an unbreachable system, - one 
. " ' 194 
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that would be Both legally^ protected and physically secure at each end. so that* the', 
data fjowing between the participating facility tenninal' and M^IS could not be . 
intercepted, • 

In part, the MSTS efforts were stirred by puWdc, attacks on their operation. 
In May of 1970, an article appeared in the New York Times describing computer uses 
in the mental health field j one of trte examples treated at length-, in generally 
favorable terms, was MSIS A month later, Jack Anderson wrote a nationally- 
syndicated column that attacked KSIS as a threat t'o^atient privacy -and the 
Confidentiality of the physician-patient relationship. 

"A New York State hospital ," ^he 'said , "at a co|.t of millions ^t) the taxpayer, 
is assembling an awesome data bank of highly^ specif ic, supposedly confidential 
information about psychiatric patients in seven states." MSIS "could be another step 
toward a national data center,;^ which would "extinguish forever the fight of 
-privacy." A;:idprson ^as particularly concerned with\the possibility that government 
investigatlve"agencie« could subpoena patient information and that the "all-knowirfg, 
never-for^'tting electronic machines could produce at the press of a button a person' a ^ 
life £a?t5rn cradle to ^^ave."-^ ' *\ , 

The Anderson attack was followed by inquiries from a number, of concerned groups 
who voiced their concerns over possible violations of privacy. Senator , Sam Ervin 
and a number of individual members of the House- of Representatives wrote to HEW to 
find 6ut what precautions were ^b§ing taken to^grotect confidential information. 

-^John Shattuck, the ACLU staff . lav^^ef^ in privacy' issues , wrote also, 

and noted that the ACLU was particularl5^oncerned that "without proper safeguards, 
these (psychiatric records) could well fall into the hands of unauthorized people." 
^ . .In Sanford, Maine, employees of the state and federally funded- York County 

Counseling' Center refused to fill out the Admission and Termination forms, believing 
it an unwarranted invasion 'of privacy, to amass and maintain such data on blients 
without thexK: express consent. " - ^ 

To meet these, problems, MSIS hired Dr. William J., Curran, Professor of Legal 
Medicine at Harvard, ^s its iegal counsel in 1970. He \nd his staff surveyed the legal 
situation in-*each. of the participating s plates' and examined methods of insuring that 
adequate legai safeguards were present for the centra^ databanks'. 

One. possibility they considered was the transfer of control and ownership of * 
MSIS to the Uevi York :State Department of Mental Hygiene i this would have brought into 
operation -tvyo sections of ^he New York State Mental Hygiene Law tha.t protect 
confident iaiity of department records. But since the records in MSIS concern 
patients in several spates, seemed inadvisable to place them under a 'government 
agency of another state. ^It was^ decided that ^ the Research Foundation for Mental 
Hygien|[^^Xnc.- a neptral, non-governmental organization should retain control of the 
records, bul; that legal protection. for the records at the Foundation should be setjured. 

One approach conjsidered was the creation af an interstate compact, to be entered 
into hy all cooperating states? this wopld establish the organizational framework of 
the system and guarantee "the confidentiality of its records under rules that would 
be adopted by each state upon joining the compact. Such* a /compact was drafted by 
Dr. Curran, but a number of states rejected It as too formal for an operation at thaV 
time still regarded as in the experimental stage. ' 
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The alternative chc^en was to seek a special enabling statute from the New York 
Legislature. extending conf'identiality to MSJS and all of its records, The statute 
would make ,the records private and privileged documents, not' the property of the New 
York Department of - Mental Hygiene, nor open to public-record afccess. 

The bill, introduced into the^ New York General Assembly early in 1972, stipulated 
that the records and inforjnation stored in the system by facilities located' outside 
New York were "not open for inspection by any agency or individual other than the 
agency or facility submitting (them)" and were "not subject to subpoena in any court' 
or before any tribunal or administrative agency." ' 

The prohibition of any subpoena was ^justif ied to the Legislature on the ground 
that all of these* records are secondary sou/ces of information ahd that the best 
-evidence for any court proceedings is in the records maintained by^the participating 
facility. Therefore, any subpoena shcruld be addressed not to MSIS, but to the 
facility at which the records originated. ^ ^ - 

The bil^ also provided that the New Yorfe Commissioner of Mental -Hygiene was ' / 
empowered to conduct an annual review of the system tOj,ensure ijfcs proper and lawful 
operdTtion in the interests of the cooperating states and facilities. Finally, the 
Sill gave MSIS the authority to release aggregate data for research purposes, 
provided that* all patient identi^'iers were removed. ^ - 

This path-breaking law to provide specialized* status ^to a regional medical 
inforjnation system became part of the New York Civil Rights , Law on Maj' 15, 1972, Thus 
the general conf ider^iality of records stored and controlled by WSIS were assured by 
law. 

But it must b6 underscored that the confidentiality of records stored Locally 
by the participating facilities (as with the questions of access and privacy) are* 
still governed by the various st^e laws, just the 'same as other local facilities 
that are not participants in the MSIS system. In Connecticut, for example, a patien^te 
record may be subpoenaed, and state laws require, the mental health centers to give 
certain information to various third party payers. According to Lanse Crane, sm 
attorney and assistant to the Director of the Connecticut Mental Health Center, the " 
Welfare Department and the Department of Finance and Control have the widest access 
to patient inf-ormation . "When it comes to issues of *mQney and paying for treatment, 
confidentiality normally takes a back seat." MSIS sees the issue of bolster^ing the 
confidentiality laws in all their user states as an important task for their 
attention, especially as more states join MSIS or similar regional medical data banks. 
In late 1971 • MSIS commissioned an analyi^is of the law in each of its participating 
jurisdictions. The study found that New York v/as the only one with a clear general 
statutory right of privacy. Court gt^isions in several other states recognized 
a common law iight of privacy v/hile two states, Rhode Island and Vermont, had not 
recognized the legal rifeht of 'privacy. 

As to psychiatric records specifically ,r the study found the New York law to have 
the broadest coverage here as well. New York recognizes a confidential relationship 
and creates a testimonial privilege for communications between patients ajid their 
physicians, psychologists, nurses and social workers, A few other states recognized 
only a patient-psychotherapist privilege. 
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As for patients* clinical re'&ords, consultant reports, psychological .tests, 
djru^ administration records, and other records kept by mental health facilities, 
these are legally the property of t^e facility.^ t)f the sta^tes that we're then 
participating in WGIS (late 1971) f fve— Connecticut , Hawaii , Massachusetts , Vermont 
and Nelv York — had statutes establishing the confidentiality of such patient records 
in mental health facilities. Neither Rhodd Islarjd nor the District of Columbia had 
'^.explicit provisions protecting the confidentiality of such records. 

WSIS has taken other steps with respect ^to confidentiality in addition to 
sponsoring the Amendment to the New YorJc State Civil Liberties Law and to encouraging 
passage of state laws, v ' , 

In 19*^3. Dr. Laska wrote HEW Secretary Casper Weinberger, requesting that MSIS 
be "authorized as a confidential sj^stem under Sec. ^5-82 of the Federal Public, Health 
and Welfare^ Law. " Such authorization would give MSIS the right to withhold 
inf ormat^ion identi^^ng the individuals! who are the subjects of alcoholism research 
or treatment . "from all "persons not connected with the 'conduct of .research on, ot 
treatment with respect tOf alcohol abuse and alcoholism." Although th§ Secretary 
- responded that a decision would be fonthcoming quickly, as of late 1975, despite a 
seco^id request, HEW had given only uritpfficial indications that MSIS would be covered. 
•ySIS is assuming they are covets, .but still awaits' an official finding and notice. 

Physical Security r ' • . ; 

Several technical safeguards are 'employed 1^o protect the physical safety of* 
MSIS records. Through a j>assword system^ each terminal has access onlyc to its own 
data files, not those of any other user. Entrances to the Research Center where the 

. MSIS computer is located are guarded by ]j|rsonnel or, by electrical security devisees.* 
A guard is posted at the only entrance left opep at night j all other entrances are 
rocked and are protected by an alarm system. The computer room itself is locked with 
a combination lock at all times. At each of the participating facilities in which 

, terminals are located responsibility for securing of the terminal room is in the 
hands of the directoi; of the facility, and practices there vary frqm highly secure 
to fairly casual. . ^ . . , ^ 

;A good example of this involves patifent notice of and consejnt to the MSIS 
operation. ACLU chapters in several of the states participating in. MSIS have 
complained that while patients expect their records to be compiled and used in the 
local facilitiet treating them, or that identified data may^e needed, for state 
health-care evaluation and planning, they *do not expect— nor" would all of theiJf 
/welcome — the sending of their extensive,, highly-serrsitive records to a central ^ , 
cpmputer in New York State ."^ The ACLU complaints have stressed that MSIS may be an 
exemplary system in terras of its -donf identiality safeguards, but, if so, it should be 
alJL the more willing to have the patients whose records will be lodged there informed 
of. this practice. When the purposes and uses of MSI^ and its prOtectifc are^ 
explained, the patient (or a legal guardian in case incompetence )^HR''make an 
informed decision as to whether , his or her records should go into MSIS. Not to 
provide sjach a process, the ACLU groups charge, is to create just the kind of % 
"secret data system" that the 1973 HEW Repprt, the federal Privacy Act of 197^. and 
several state fair information -fffl^j^^Sj^gts ha\% condemned as unacceptable. MSIS 
^officials have not yet faced this ^^fe hfead'fen, but have treated it as a matter / 
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goveril^d^y'Tilie rfotTce an4 consent policies of-the loc&l facilities. <, # 

Despite its efforts on behalf of confidentiality, and more important, despite 
the fact that no one has documented a single leak of information* from MSIS in the 
eight years of its existence, or any violation of the strict rules of confidentiality 
under which it holds personal patient data, NfSIS continues ,to draw considerable 
public fire on citizen rights questions, , * , 

* Future Plans ^ * 

* . r^SIS pervsonnel are^ developing a financial system to help mental health 
facilities track costs. Their major new activity currently is development of an 
i*hformation system for treating the mentally retarded, under a 3-year grant from the * 
oocial Rehabilitation Services^ of HEW, They are also conductin'g' studies under ^an 
NIN^H gran/ of how psychiatric recor4s are actually used by clinicians and institution^ 
^in their decision-making as to treatment. Another project is to design an outpatient 
drug f^eview system. MSIS officials see the use of their sy^etem as a bedrock* for 
FSRO rjBview of mental health care, and a necessity if and when a national health 
insurance program is enacted. "MSfS will have a major role in setting quality care 

•standards in psychiatry," Dr. Laska believes. Meanwhile," new states continuje to 
come on^o the sygtem 6|kch year, or utilize its > sof twaire , or purchase its forms. 

Observations 
1 

Cpnsidering all/ of ySTS efforts, and considering its unbreached 3ecurity record, 
.jfrhe protests about iits activities, in another era, would very lik'fely be considered 
somewhat paranoid. JEn today's world, t)iey are, alas, all too plausible.,- In the 
last three yea;rs, the American people have been bombarded with documented accounts 
of e-overnment investigators illegally obtaining confidential information— confidential 
^information protected by both physical security and by laws ^as stringent as the New 
York State Civil Rights Law, V/hile the bre^-in at the office of Daniel Ellsberg's 
psy'chiati^ist and.tjie exposure of Sen. Thomas Eagleton's psychiatric history are the 
^most notable in the area of' mental health records, other violations have done as much 
or more to create cynicism about the supposed corif identiality of health records,* 
The FBI's ille^arVire- tapping of members of the ^National Security Council, the CIA's- 
illegal opening of mail of hundreds of thousands of American* citizens j ^he stealing 
of records bV the FBI or its informants belonging to anti-war groups such as the j 
Institute for Policy Studies - all these, and more have heightened public consciousness! 
of the fragility of so-called confidential records, Addinf/jo the climate of 
distrust aV6 the activities of local law enforcement agencies which have been 
revealed in the past few yeaRS: police ^departments in most major American cities, 
New York, Baltimore , WasJ:iingt on , Chicago and Los Angeles among them, have been 
cTiarged w^th illegal procurement of confidential^ documents,^ 

In this atmosphere, it is easy to conjure up situations in* which the 
confidentiality of systems likfe' MSIS might be overridden in the' interest of **nationalv 
security" — tracking down a potential presidential assassin,, say, or an unstable 
security risk. It is easy to imagine that its confidentiality might be overridden 
for law enforcement — tracing a kidnapper who^j^ ^thought to be an ex-patient. Once 

I '. *\ / ' ' x'-*. ^ * J ^ 

♦Made public. Ironically, by jacic Anderson. . ' , ' 
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breached for such overriding concerns, the system might be riddled by investigations 
of every kind because 'the very existence of easily-retrieved, identified records 
on. people whose problems include drug a'buse, alcoholism, sexual deviations and 
violent episodes Is a tremendous temptation to local and national law enforcement * 
agencies; iferefore the very existence of such systems tfireatehs citizens' ri\hts, 
its critics conclude. 

There is no facile answer to the question of how to reconcile the.nee^ to deliver 
the impf-oved mentj^ hearith car^^ that MSIS promises with the need to guarantee, in* 
some as yet undefined way that'goes beyond the laws and bejrfSnd physical security, 
the total confidentiality of mental health records. Yet the public acceptance of 
systems like MSIS will depend on developing strong ^and publicly-acceptable safeguards.^ 
Again, we will return to this issue in our concluding chapter. . ' 
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CHAPTER 10. MUTUAL OP OMAHA INSURANCE COMPANY * n . 

Mutual -of Omaha is' a inulti-line insurance company with health insurance as onel 
of -its major offerings. A profit-making enterprise, its operations are guided by the 
standard of cost-effectiveness and commercial success. We chose Mutual because it is 
the largest and best-knovm of the commercial health insurers in the United States, 
because it is on6 of the most advanced 'computer users among Zone 2 service payers, 
and because recent privacy legislation has not only had some important effects on 
Mutual 's data collection practices, but has also raised questions about how Mutual 
will select-j;^sks and adiftnister claims investigations in the future. 
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Background on Mutual " ^ ' . 

Organized, in 1909^ Mutual has grown along with the health industry and is now 
the world's largest provider of individual and family health insurance. It offers 
policies covering hospital and surgical payments, extra hospital expenses, payments 

^ for specific -diseases such as cancer, income protex^t^on for illnesg, or hospitalizati 
and 'a variety of plans that take effect when programs like Medicare or Blue Cross ^top 
paying7 Mutual is licensed throughout the United States, Canada, Britain, .Puerto Rico 
and a few other locations. Seven other subsidiaries offer life insurance, mutual 
funds, travel insurance,, and other lines, and Mutual •s assets in, 1974 were over 

" $750 million. 

i * 

Information Collection for Underwritine^ 

As with other commercial insurance companies. Mutual, while eager to sell as 
many policies as possible, is also eager to weed out policy applicants who are poor 
health risks, or are unlikely to be able to pay^their premiums, or might make 
fraudulent claims for benefits. These goal^ dictate the collection of a broad range 
of Information directly .from the applicant for a policy—information about the 
applicant's financial' off airs, job 'and style of life, in addition to medical history. 
The medical part of the policy application calls for an account of injuries and 
medical treatment " and a listing of diseases, including high blood pressure, 'arthritis, 
cancer, syphilis, epilepsy and mental disorders. 

Until recently. Mutual *'s application included the question i "Are your and your 
dependents' morals and habits correct and temperate?- -While few people were expected 
to answer "no", the 'compan;/ saw this as putting the applicant on notice that his/her 
morals would be considered in deciding to issue a policy. The question was recently ' 
^deleted from Mutual*s new application, after the company decided it^'Aidn^t provide 
the underwriting department with any use fill information. "What one person considers 
moral," comments Albert Hansen, Senior Vice President, "another does not...We\re 
much better. served by the specific inquiries (e.g. whether the applicant has ever 
been treated for' alcoholism or drug addiction, or had venereal disease) in evaluating* 
•tfie individual^medically 'as well as from those habits whicTi could more likely affect' 
insurability." The Company says that an ^admission of having been treated for either 
^alcoholism or drug addict itn will not by ftself -result in denying coverage, but would 
depend on the results of further investigation. In addition, "no" ' answers will not 
be investigated. However, should it subsequently be discovered (e^ecially in a 
claims proceeding) that the applicant had not lold the truth about a substaiitive 
matter, the insurance contract could be declared in^lid and the* claim defied. 
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Although questions about moral^ and habits are now omitted from the applicant's form, 
they still piety a rolfr when the *Qompany^ecides to make an investigatory check of the 
application* (See below), * 

In compliance with'the federal Fair Cre(iit Reporting Act,' which, took effect in 
1971 f the company includes in its poli^iy applications a pre-investigation^notice 
which reads as follows t * . " - 

"This is to inform you that as peirt of our procedure for processing your 

application aft investigative consumer report may be prepared whereby information is 

obtained through personal interviews with your neighljors, friends or othet^s with whom 

» 

you are acquainted. This inquiry includes information as to your or your dependents' 

(if family insurance) charscclter, general reputation, pers(*ial characteristics and 

t * 

mode of living. . . " 

This notice is detached from the policy and. handed to the applicant when he 

fills 6ut the* form,' td insure that proper notice has been given. 

* -1 ' r . 

As part of the applicsgtion , the prospective. customer lists the doctors and 
♦X ^ 

hospitals from whom he has "deceived treatment. He Signs a statement which authorizes 
"any physician, hospital, insurer or other organizations hgxuig any records or 
knowledge concerning ^(t>he applicant), or (his) ^dependents to giVe Such 'information to 
yutual of Omaha Insurance Company." If important health history items airfe listed, 
the company, using this authorization, may ch^ck further with the physician cr 
hospital. "IrJ general, physicians and hospitals comply wit^h our requests for medical 
^data," remarked Hansen. **0f course, there is always someone who .decides for one 
reason or another that everything is confidential." In that case, the companjr's 
medical personnel would evaluate the situation and decide ^hethfer to go ahead or to 
require further disclosure of verification from the applicant. 

In addition to the individual application. Mutual uses a number of other sources 
to investigate some applicants. It checks its own^files to see if there is any 
previous coverage or claims records. It ha^ Its own investigators meike an inspection^ 
in cases where •*an application is incomplete or otherwise suspicious, or because the 
policy applied for is a large one - for instajice, to cover more than $300 pe,r month in 
loss-of-time income.** 

* Where their own investigators are not available. Mutual may get an **inspection 
report** from a commercial reporting firm such as Equifax (formerly Retail Credit) or 
Hoopepr Holmes. Hansen notes that '^these are fairly minimum checks; we get something 
on Veneral character through reputation elicited from neighbors and references listed 



♦r.'ofe^^^ the reports that Equifax does for Mutual are Income Protection Reports, and 
are h^hd Wd by, personal or telephone interviews with the applicant. The report has 
sections on health, drinking, and drugs. Among the health questions are ones ask^ing 
about any illnesses or operations, regulai; medication, rejection for military service 
or disqhairge for medical reasons, name apd address of personal physician and "when was 
last visit, for what reason, v^at results." If the applicant is not availa^ble for 
direct interview, Equif^ will contact dn employer ^ or he ighbjpr, and ask^ abou'^ that 
person's knowledge of tlie^e facts. Such persons ^are also aslofed .whether they know 
"anything adverse about character, life style, general reputation or home environment.* 
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on the application ^ .and we confirm , things lil^t.emplo^ent, length .of .residence and 
neighborhood environment, '^e don't automatically, assume that all of the infomvajiion 
we see iri an imjestigatory report" is true, A^l findings are subject to verif i^tion, - 
Aboi^,a thir'J^r these investigations are done by Kutual's own people, and two-thirds 
by outside commercial firms. Of the 700,00.0 insurance applications received annually, 
about 50,000 (7%) are checked by inveslfigatiohs . 

Mutual approves at- least 95^ of the applications submitteti to it. This means ., 
that about 30 to 35 thousand people a year art denied health insurance policies. 

Health history is by far the most common. reason for denyirg coverage, but other 
factors sometimes play a role. Actuarial studie^x^ich take into account age, sex [ 
and geographical area tnay also be determinative, "^metime^ geographical factors. - '* 
come'tp," a Mutual of f icial ^s'aid, -for instance in parts ^of some cities where the % 
health and hospital facilities and environment may b'e very bad.T Although it can be 
inferred that such geographical factors would be most likely to come into play in 
ghetto areas, whose popuiations are largely blacl^ or Spanish surnamed, race cannot 
be an explicit factor in insurance underwriting under federal Civil Rights Laws, 

Asked 'about homosexuality in health insurance decisions, a factor about which 
protests have been raised in the life insurance industry, a Mutual of f icial ^said j- 
'-It doesn't come up and we don't look for it, even if it did cQme up, we wouldn't use 
it unless there was accompanying information with some real health implications, Xou 
have to realize that we want to sell insurance e^nd that most of our policy- 
applications go through without a hitch," ' ' , 

Mutual, like most of the insurance industry, feels somewhat inhibited .in its 
information-gathering activities because of the Fair Credit ReportiJ^g^ct (FCRA). 
^Accotding to Hansen, certain applicants may believe that they no longer have to 
answer certain inquiries posed by investigators. As a result, the company finds that ^ 
investigative reports that it purchases from 'outside commercial firms , (Consumer 
Reporting Agencies, under the Act) 'are not a? useful as they were before the FCR4 was 
passed. "To illustrate, in order to qualify for insurance, a person must have^a 
certain income. If an applicant's financial situation is shaky, for example he has 
walked away from two businesses and filed for bankruptcy! you may not want to take 
as great a risk on him as you might ordfnarily, or you might want to charge a higher 
rate for the coverage applied for. for all we know, the applicant may tie. setting us 
up for a disability. The Fair Credit Reporting Act might preclude the^mpany from 
securing that type, of finart^dal information." ' 



Claims Investigations ^ 

Claims for benefits call for further information-gathering on policyowners. ^Tq, 
collect on a claim,, the policyowner must submit a proof of loss form on which he- 
au^orizes his physician to furnish medical information. Where a policy pays as soon 
as% disease is discovered. Mutual may request only a diagnosis from the physician. 
For other kinds of policies, detailed'descriptions of medical procedures are required. 
However, the company says that most investigations of claims are made only to - 
establish that the loss is covered within the framework, of the policy provision.. 

I 
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Computerization At Mutual 

In. 1954, wheh Mutual's yearly business had grovm to $5.1 nSQlion in policy 
applications and $5.9 million in benefit claims, a committee from i^lutual and its ^ 
life insurance affiliate. United of Omaha, began to plan for automatin^Wome of the 
firm's routine ,and costly high volume tasks. At every step in the planning process. 
Mutual Officials recall, cost effectiveness was the key criterion, (A recent industry 
study found that Mutual 's operational expens'es aire less than the combined average of 
the next 24 companies in the field). u 

James J. Kohanek, Vice-President for Comjrtrter Systems, says that since the 
company's first computer was delivered in 1957 >\he operation has grown so that, "now 
we do everything but cut the lawn with our computers. The core of the system is its 
Consolidated Policy Accounting System, covering its regular ;lines' af- i-odividual health 
policies and handling s^ome $20 million in premium payments each- month. This is a 

• '-'i- '«««« 

batch-processed file containing detailed records for e&.ch current policy: identifying 
information, premium payments, benefit information, etc. The system handles 70,000 
benefit requests eaqJi month and issued neairly 9f000 benefit checks each weekday. On 
a given day, approximately 900,000 activ;e^enef it records are on tape, containing 
skeleton historij&s on the benefits granted and i30"ded references to types of disability 
involved. The local Mutual representative, presented with a policyowner's benefit 
claim, can usually be) supplied by the following morning, with the account information 
he needs to'^ begirh*-pf*ocessing the claim, ^ 

Because Mutual finds benefit history important for developing new health 
insurance policies and for considering new applications from individuals already 
covered under another Mutual policy, they store on tape the benefit histories of more 
tham 5 million- policyowners. Each record contains items such as diagnoses, benefits 
paid, and actions taken on the policy. These are available on an overnight basis 
to authorized Home Office personnel. 

In addition to active individual policies, the computer also handles the^ 
processing of benefits for its group insurance programs, keeps some records on Muti^^ 
employees and agents,! and produces management repQrts, 

Mutual 's Role i.n Medicare and Champus Programs ' . ' 

Mutual serves as fiscal intermedieury for Fart B of the Medicare program (payment 
0f doctor and outpatient bills) for the State of Nebraska, processing about 440,0,00 
claims a year under an au1:;^or<iated system developed by the Social Security Administration, 
It also handles 435,000 Medicare Peirt A claims (hospital billSj) for various hospitals, 
h|€S3.th agencies, and nursing hojnes in 31 states and* the District of Columbia! these 
are handled through manual procedure's. 

Eligibility data on all Medicare benef icisuries is stored in Baltimore in the 
computer files of the Social Security Administration, When Mutua^l receives a chaiTge 
claim under Medicare Pairt B, it finest ,cpnducts a computerized "medical audit to see 
whether it falls within *^acceptable parameters". A manual examination is done to see 
whether the traettoent was really necessary and whether the health service rendered is 
covered by Medicare. Claims meeting these criteria sure keypunched and aent to the ' \ 
SSA central file, to verify eligibility. If the reply is satisfactory, Mutual's 
computer issues the checks. Both by law and contract, eligibility information 
obtained from SSA tapes, and communications cannot be used for any other purpose, 
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According to Ben Patterson, Mutual •s director of Medicare Administration, the 
automated' system is by no means flawless. There are often delays in receiving 
eligibility data from the Sooial Security Administration, and each time there is a ' 
legislative change in the program, it takes a substantial period of time for the 
computer programming alterations to arrive from Baltimore. .Nevertheless, "(Df it 
weren't for the computer there would be no Medicare program, he saidr ***we would be^ 
^. drowned in data.*" Furthermore, the problems of detecting duplicate- cia^ims has been ^ 
substantially alleviated, ^ ♦ 

The Civili^ Health and Medical Program of the .Uniformed Services (CHAMPUS)' 
is a federal program, to pay the cost of civi^lian medical services for dependents of 
armed forces personnel where such services are not availab^^CL.militariiuhospitals. 
Eligibility is limited to dependent spouses and children of service members on active 
duty or training? certain retired service people, and dependents of service people 
kj^lled on active duty. Among the services covered' by CHAMPUS are treatment of 
medical or surgical conditions? nervous, mental and emotional disorders? chronic 
conditions and diseases? allied medical service suchi as occupational and physical 
therapists, audiologists, social workers, and remedial reading teachersi abortions, 
if locally legal? family planning services, marriage and pastoral counseling? and 
prescription drugs. 

Mutual processes CHAMPUS hospital claims in seventeen states and physicians 
claims in six states plu^ Puerto Rico, Canada and Mexico. CHAMPUS claims are 
processed by an integrated on-line system, with sixty-three tetTninals, 

Fifty-six te^inals are dedicated to the claims audit function and each CHAMPUS 
claims audi-tor is issued a code that permits access to these terminals. When a claim 
is received, the claimknt*s name, social security number, date of birth, and oth^r 
. ^identifying data are fed into the computer, which audits the charge for the services 
rendered. In addition to issuing checks to claimants, the computer generates daily 
disposition lists of ^11 claims processed, letters to claimants requesting additional 
data, and explanations of benefits. ^ 

Sixteen months of benef^its history are. stored in Mutual 's CHAMPUS data bank. 
^^^^ beyond that period are stored on microfilm. All claim records are filed 
in cabinets and, are identified t)y an internally developed numbering scheme. 

Originally,. Mutual processed all CHAMPUS claims manually. The decision to 
automate in I972 wa^ prompted by the program's requirement that intermediaries develop 
fee profiles on physicians rendering health services to CHAMPUS beneficiaries. 

Citizen Rights Issues 
1. Confidentiality 

Mutual regSi^ds its information about policyholders as confidential, for internal 
use.. However, it faces many problems involving .release • of such-data to outsfde 
agencies, ahd its sharing practilJes have undergone significant changes during the 
' past few years. For example, health information is no longer shared^ithin the 
industry through industrywide pools Mutual used, to forward limited information on . 
policyownei;'s suspected of filing fraudulent claims to the Casualty Index, an 
industry file in New York which maintaj^eS' natiohal records for this purpose. The 
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practice was discontinued In 1970. Mutual felt there was little danger to 
policyowners in contributing to and using the Index, but they were concerned about 
what policyowners might think about this exchange, and it was en<^ed, . ' 

Where a group health policy is written for all the employees of a company or 
agency, and Mutual administers it directly. Mutual does not release identified^ 
employee health information to the employer. However, if the employer administers 
the program through its own claims office. Mutual has no way of knowing what is* done 
with information about physical or mental condijtlQns that might be disclosed in 
claims forms. Dr. Robert Long, MutusuL's Associate Medical Director,' noted that 
there might be extreme situations — "entirely theoretical so far" — in which Mutual 
might learn of a health condition and feel itsel^gs^lity bound to notify the employer, 
such as "a person who was epileptic working with' heavy machinery." 

In 1973i in order to insure compliance with the Fair Sredit Reporting Act, ,; T" 
Mutual revised its regulations governing the release of information "to other insurers, 
jfl^ithout a signed author iz'at ion from the policyowner, release of information is now 
limited to the policyowner's name, address, date of birth, and occupation, plus the 
type of policy issued, issue date, amount of coverage, and the current stratus of the 
policy. With a signed authorization, release is limited to the previously described 
items ,^ plus the amount of benefits, other final claims dispositions,^ and th^ source 
references of medical information contained in claims files up to the^'date of the 
authorization. ' 

> 

As far as state amd federal agencies are concerned. Mutual off icia^;^gg;ive 
confidential data only when"we have no legal basis for denying the request." Mutual 
General Counsel Robert Muchemore recalled one instance in wJjp.ch the Missouri State' 
Insurance Department insisted on copying various files. Mutual balked, but eventually 
complied when it realized that the^ Department could compel the production of these 
records at the Insurance Depgirtment, which could then make._£ppies . The Internal 
Revenue Service also demands and obtains individual data from Mutual. By law, the 
IRS has a lien on monies due benef icisiries who are federal tax delinquents. As a " 
result, Mutua^l is required to respond to IRS inquiries as to whether or not the 
company is liable to a part icular policyowner, if so. Mutual must withhold the 
benefits from the insured and pay it over to IRS. 

At one time*, IRB requested health insurance carriers' to report all paymqjpts 
made t^o pol,icyowners in reimbursement of dodtor bills. A number oT companies 
vigorously resisted, and IRS backed down. However, as of 1971, all insurance 
companies must report to ips the names of physicians to whom they have paid more than / 
$600 a year . . ^ 

Law enforqement officers occasionally approach Mutual with a fugitive warrant 
an^ ask for the address of an individual. This is provided. However, "no medical 
or benefits information is released," accordir^ to Mutual officials, and Hansen could, 
recall no instance in which law enforcement agents requested such information. 

"FBI agents come around perhaps three or four times a month," says Mutual 
official James Bairrett. "Usually what they want is location information, or they are 
interested in the flight insurance area - for sabotage cases and for tracing the 
^inter*§tate movement of criminals." 



In spite of the fact that some reporting to the federal government must be by 
* soQial security number - (payments to physicians, Medicare and Champus claims) - 
Mutual continues to use its ovm numbering system for indj^vidual^ accounts. According 
to Kohanekt the company does not want to adopt social security numbering because it 
would ''greatly iificrease the problem of confidentiality,*' * ' * 

2v Computer Security 

Officials at Mutual recognize that computerization leads to. .greater demands for 
both identified and statistical data. As an example, Mr. Kohanek mentioned the IRS 
requirement o)i reporting payments over $600 to physicians t and he cemented i •'The only 
reason we're asked to do it is because it ^ can be done now by computers," Before 
computerization it would have been prohibitively costly to retrieve the requested 
data. Today, the government knows that the data are readily available at aittle„„ * ^ 
cost, and so they demand it, ' - 

^ , Protection of files from "unauthorized access was included in Mutual 's earliest 
computerization glans, * Only authorized personnel are issued access codes to the < 
^ . computer, and only within theii;^ delegated area. For example, though th^ underwriting 
depairtment is giv.en access to information collected by the claims department , 'the 
claims department is not thought to require underwriting data and so claims persftinel 
^are not provided with underwriting access codes. Medicare and Champus personnel each 
' h,ave access only to their own data files. 

All requests for information not covered by existing rul^ inust be in writing 
Wid approved personally by Kohanek, a requirement that he feels fius-eut down the number 
of requests. The move to computers by itself reduced the number of people handling 
and duplicating flies, and this, too, reduced opportunities for unauthorized access, 
Physi9al secuirity for the computer was strengthened in 1969 following a false 
bomb threat. Accounting controls over the huge sums of money involved in income 
^ premiums and outgoing benefits also operate to prevent unauthorized access. In sum, 
^■'jjMutual officials believe that confidentiality is fostered by their computer security ' 
rules £uid procedures, — J 

The company stresses confidentiality to its agents and home office personnel, 
^ ^Training materiaFs instruct them never to release confidential information to 

unauthorized people, never to i;ranslate the codes on rejected applications for anyone j 
•^and never to discuss confidential information with applicants, policyholders, or 
physicians. Every three or four months. Mutual distributes a bulletin reminding 
en^loyees of the compaivy's confidentiality rules. According to Hansen, Mutual has 
never had any problem with employees divulging confidential information. General 
>Counse^J||chemore said the company had not received complaints of breaches of 
confidentiality, nor had it been sued over such an issue, 

3* Policyholder Access 

Policyowners are permitted to see their files (including data secured by '"^^ 
inspection reports) so long as they furnish proper identification. The data is ' 
given only in person, and not over the telephone. However, policyowners will be 
given 'copies from their files only of stat^&ents they have signe/d (e,g. the * 
application form) ,and the bills they have sent to the company for payment; other ^ 
docXjments especially those from third parties, csuinot be copied, 

• . / 
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Mutual believes that insurance carriers should disclose medical iAformation not 
^own to the individual only to a ]^ersonal physician, not the individual diijectly, 

•This will come closest to "an absolute guarantee that such information will be 
properly explained," Br, Lpng stated, and -^'the . possibility of arousing feelings of* 
doubt, fear, anxiety, or angeV will be held to a minimum." Thus when Mutual gets ' 
medical information from a hospital or physician that affects itfe underwriting 

^decision, and if the applicant asks to see th^s, Mut&il will write b^<# to the 
hospital or doctor and cair on them to explain it to the patient, "We don*t 
want ..to interfere with the doctor-patient relationship," said Dr, Long, 

The Pair Credit Reporting Act has played a significant role in exp^anding 
.consumer access *to ifisurance company file^, including Mutual's, As no-d^d earlier, 
insurance companies must notify each applicant that the company m^y investigate or ^' 
verify the personal information "supplied. If insurance is denied on the basis of an 
inspection by a Consumer Reporting Agency (that is, one of the outside commercial 
firms as distinguished from Mut'ual's own investigating staff), the insurance company 
must give the apfjlieant /Or policyowner the name of the company making the report, 
and he may^,then go there ti find out its content and take further action if he 
thinks it> incorrect, 

Gejrie fteVz, second vice -presif dent forv underwriting and renewal, says that Mutual 
receives relatively few inquiries or complaints under *this law - generally less than 
five a weekjj^ "To the best of my knowledge, .we haven't needed to cprrect any action 
yet on the basis of anything turned up in a customer inquiry, though we'd be glad to 
if we found out that there had been some mistajje,". 

"Many of the calls we've gotten,^ another Mutual official noted, "are the result 
of the notice people receive informing them* that an inspection investigation will be 
completed. They want to know, who we will ask, what the topics will be and so forth. 
We certainly don't have any difficulty replying to any of those' calls , " 

For its work in Medicare, Mutual comes under the , federal Privacy Act of 197^ 
(P,L* 93-579) • which became operative in September of 1975. Regulations under the A(;t 
designate csirriers and intenq^diaries under Medicare to be components of the Bureau 
of Health Insursince of the Social Security Administration. This requires them toi 

(1) permit an individual to determine what records pertaining to him 
are collected, used^ or disseminated by such|pgencies i 

(2) permit' an individual to prevent agency records pertaining to him . ^ 
from being j^ed for any purpose not compsftible with' that for .which- 

' . obtained; * • • • 

(^TperiniT an individual to gain access to information pertaining to 
him in Federal atgency records, and to correct such records when 
appropriate ♦ ^ ' 

• In order' to comply with the requirement^ of the Privacy Act, ej^ch Medicare 
contractor must t 

(1) inform each individual from whom information is requested of his or 
her rights under the Privacy Acti 

{Z) identify pertinent systems of records to be described in the Federal 
Register i . - ' v 

'(?) describe the method of accessing individual's records i 

{k) prepare aT method of accounting for disclosuresi ^ * 
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(5) devise a method of reviewing records at the request of individuals 
and making corrections if appropriate • 

Mutual has instituted these procedures-, but it is too early to judge what ^ 

effects the Act will have on either Medicaire claimant behavior or the underwriting 

and claims processes. When queried in Mgirch of 1976, Dr. Robtart'S. Long, Mutual's 

Associate Medical Director, reported that the company* had received few if any Privacy 

Act inquirijBS under either Medicaire or CHAMPUS. There was s0me concern at Mutual 

that the Act might cause rep6rtihg sources to •'dry up" a bit, at least temporarily 

while the Act's provisions were being studied and experience under It observed, ' « 

■ ■■■■ V : . '■ . ■. " 

Observatibns • 

I/utual's experiences as a highly -automated service payer indicate that \ 
Computerization has not changed the way it dealrf with citizen rights. Its traditional 
policies protecting the confidentiality of policy-holder and beneficiary data have 
,been reproduced in its automated systems. Data securitj^ is probably, enhanced rather 
than lessened in its computerized systems. And as Congress has written new laws to 
protect citizen rights, Mutual h?^ complied as fully in its automated as its manual 
operation^, and as well as health insurers who aire less computerized. 

The important citizen rights issues that lie ahead for firms such as Mutual -are 
almost entirely issues of social policy, not technology, will American society cho6se 
to intervene by law in the risk-selection, process to limit t^e criteria that may be 
used (and the investigations made) by insurance companies— as with sensual preference, 
cultural life style, and racial^based "objective- health conditions? Will society 
reject Mutual 's stand in favor of revealing sensitive health data only to a chosen 
medical representative, rather than the individual directly?- 

For the first of these, the fact that Mutual is a private profit-making 
organization is important, since the selection of risks is critical to competitive 
success, and private firms have sometimes been allowed to continue applying criteria 
of selection thJt government— bound by the Bill of Rights— cannot. But in the second 
area— patient. ac/5ess— Mutual position echoes that^of ^mcTat governin<?n-^ health ' 
professionals and' agencies, and it would be mistaken to apply a public-private 
distinction. * 

^ Beyond these questions lies^the role that firms such as Mutual will play-ln 
any future system of national health insurance. The possibilities range from their 
being intertnediaries ip almost the same fashion as Mutual now is for Medicare and . 
CHAMPUS to their role' being limited to the' offering of supplementary insurance beyond 
a basic, population-wide, government-administered health payment plan. Important 
citizen rights issues will be involved here, and we will retum^to this theme in the 
report's final chapter. ' ^ * . . 
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SOURCES 
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Part of this profile is drawn from an eairlier site visit to Mutual and the 
resulting profile developed by ^the' Project on Computer .Databanks of the Nationstl 
Academy of Sciences' Computer Science and Spgineering Boaird.* This was published in 
V/estin,Alan P. and Bakef, Michael A,, Databanks in a Free Society (New York: • 
Quadrangle/The New York Times Book Company 1972) pages 143-154. A site visit for this 
project was made in August of 197^f by staff member Richaird 'Silberberg. Thereafter, . 
additional written materials, letters, and telephone interviews were developed through 
March 10, 1976, primarily by HeleneToiv and Alan Westin. ^ 

The following Mutual officials provided interviews used in the writing of this 
p'rofilei Senior Executive Vice President Albert Hansenj Executive Vice President-, for 
government Related Programs Charl^ Herrrtknekr Director of Medicare Administration 
Ben Pattersoni Assistant Vice Presid^ent for Med^icaire Administration Richard Bathi 
Assistant Vice President Tor CHAMPU^ John Wrabetzj General Counsel Robert Muchemorei 
Associate Medical Director Kenneth Fletcher j Assistant Vice President Len Tondli 
Associate Medical Director Robert Longj Mr, Thome Dillon j Mr, James Barrett 1 Vice^ 
President for Computer' Systems James /^Kohanek,, ^ * 
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Part Four . 
Policy Alternatives 



CHAPTER 11. ASS^S^iNG THE CC^TUTER'S If/:PACT ON CITIZEN RIGHTS 

The purpose of this chaj;vter is to analyze the impact' of health-data 
computerization on the ^jrfizen rights identified in Paj?t One. At the oul^set, this 
requires consideration of the social setting in which such computerization has b^e/i , 
proceed^ner. While we have touched on some of these themes before » in the^s^-vey of 
i^anual record-keeping and the profiles^ it is important to pull these elemjsnl^s' 
together here, for they represent the atmosphere within which specific incident^ need 
to be understood. . ' . i 

THE SOCIAL SETTING OF HEALTH-DATA COMPUTERIZATION 

The Computer Seen As An Instrument of Continuing Discrimination , * 

The civi'l rights movement gave impetus to the formation of many groups of 
disadvantaged people struggling to overcome legal and social disabilities. In addition 
to blacks, othier non-whites, women, and political dissidents, these groups include^ 
divejpse sets of the population such as . homosexuals , ex-nnental patients, individuals in^ 
psychotherapy, people with arrest records, the physically handicapped, people with f 
stigmatized diseases (epileptics, cerebral palsied, etc.^ ) , womeri who ha^ had 
aborl^ions, and ex drug or alcohol abusers. ^ 

The ^common element among such group^ is their claim that they should^ i^ve an equal 
competitive opportunity witl>^thers in the award of credit, eiftployment, housing, 
education, licensing, and government benefits. They contend that us^b^^fheir special 
condition to block acce^d^to thesV opp!o^*l»nities Veprese^^s a reliance on irrelevant 
*or improper criteria. ^ ^ 

On the whole, the trend in American law and public opinion during the past decade 
hster been to accept the- justice of many these claims. T:ndeed,"American'society has 
already modified substtantially the credential system that operated against such^ groups 
in the*1940*s and 50*s.^ . • / ' . • 

This development poses some sharp problems for organizational record -keeping. 
Once society has formally recognized a ^ro!fp*s right- to equal treatment, and sets up 
enforcemen^t mechanisins- to provide affirmative or even compensatory action, the 
recording of a condition is generally accepted as a practical necessity. Thus most 
women, blacks, and other racial or language minoritie^, whose conditions^We^sually 
obvious^ do not revise an objectioji on the basis of » privacy* when organizations note 
and record their statuses. , • ^ 

^ For other disadvsmtsiged grbups, however, those who have not yet won full legal 
protection of their equality rights, preventing any systematic notation of their 
condition is a prime group objective,. Sometimes, where their condition is ijot 
immediate^lX noticeable, the ^objection is to organizations conducting intrusive personal 
investigati^ons or^forcing self -disclosure to identify these matters. Whether it is 
noticeable or not, these ^groups lodge a "privacy complairrt** against the recording of 
this information because they know ^t^^Xlj used to restrict *^e^^ rights and ' 
opportunities. The demand for privsicy here is a tactic in the "struggle. to win social 
acceptance' of their condition as imma^terial to the deb is ions being made. » ^ 
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Groups challenging discriminatory data collectior^ have as much concern with manual 
r^icords as with computerized data systems that carry forward the existing standards. 
But they also see computerization as . accelerating discrimination because computerized 
data systems usually involve more systemdtlc collection, more extensive recording, 
more centralization, and easier dissemination. Health records have been a major area 
of such group protes-ts not only when it is a purported' "health condition" (being in 
therapy,, etc. ) that produces the social discrimination but also when the j^cial data 
put Jflato so fnsmy health records includes political, social, racial, sexual, or other 
criteria ^hat are then used to make injportsint "non-medical" judgments about people. 

Growing Skeptic'iW About "Data-Based" Government Social Program^ 

The iprof ile of the Indian Health Service demonstrated .the vi;feal role that 
computers can play' in collectii^^g the data needed for planning^ocially useful 
programs.. The computer records on the Papago Indians generated all sorts of 
. statistica-l studies showing the relationship between poor housing and poor health; 
the role that poor nutrition played in certain disjaasesi what diseases were most 
prevalenti what special me^dicaT equipment was lacking^ etc. But while the computer 
continues to turn out these studies, the housing of the Indisms continues to 
deteriorate, the disease rate continues jto climb, and their medical needs are not 
being met. 

The gap between the health data collected by computers for socially useful 
programs and the actual delivery of such programs is commonplace, and' it can affect 
peoples* views of the utility of data collection, as the following example illustrates. 
About ten years ago, private developers and the District of Columbia government ' 
undertook a slum clearance project for which they pledged the construction of enough 
low-cost housing so .that the original residents of the ij^ighborhpod would not be 
displaced. As a first step, they initiated an elaborate study of the housing, 
transporta-y^on, s"6hooling and medical ^eds of the residents, in which extensive 
per&onal information on welfare status, income, and health history was gathered and. 
computerised to form a corjprehensive picture of the neighborhood. In (he end, however, 
only middle^d upper middle class housing was buiTt and virtually all the long time 
residents were displaced. With this background, the annoiincement in 1974 that the 
Di.strict government would renovate Kennedy stadium cmd as part of that renovation would 
replace the^ slums surrounding the stadium with low cost housing was^ greeted with some 
ske.pticism". When a comprehensive neighborhood study was initiated, local leaders urged 
the residents not to smswer the questionnaires because, they said, the housing will 
never be built and the studies £ire just an excuse to collect personal* informatJ-on and 
that nobody know^^ h<5w it will be used.. In December, 1975, the city announced that 
while the renovation of the stadium would go forward, there were no funds available 
for the surrounding new housing, j» * ' • ^ 

* The gulf between data collection and progTEim fulfillment is especially striking 
in the federal government because, as an employer, it sets standard^- for private 
employers, - Several«years ago, the Depeirtment of Housing and Urban Development 
announced an affirmative action plan for increasing the number of its physically - 
handicapped workers. It took a census of the number of physically handicapped at the 
agency and then set a recruitment schedule and final quota. While the plan was 
being implemented, the new HUD building was beiog built — being built without the 
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rajmps* electric eye doors, special parking facilities and other features that would/ 
'make it possible for handicapped people to work them. .Ultimately the protests of HUD 
employees, 'wide publicity, and the threat of a lawsuit forced HUD, reluctantly, 
belatedly, and at great expense, to install these special features. 

These examples would belong only in a study of government planning and service- 
delivery were itjiot for. the fact that large olimbers of citizens are being asked in 
these programs to disclose personal information in order to help government maJce 
"rational" decisions, should not be a surprise to government* off icials that when 
such "rational** enterprises fail to behave rationally — that is, to do what their 
announced objectives declare — ^ci^izens will become increasingly disbelieving of th6 
promises under which they are being, asked to reveal personal datar 

General Distrust of Government and the Watergate Fallout - ^ 

If we were living at^ a time of high citizen respect for government and social 
institutions, disbelief about government promises might be reg9.rded as a minor issue. 
Government officials would generally be trusted not to misuse the sensitive personal 
data they Tiad acquired, and the problem involved wQuld be the costs of having 
collected anc^ stored all that personal data without it being effectively used. 

♦Trust in government, however, has never been^ staple of the American political 
system.' Based on the Founding Father's classically-grounded fears about inevitable 
misuse of government power, our system rested its faith on constitutional limits to 
govferrimenf authority, public exposure of government's affairs, ^d Bill of Rights 
protections for individual^and associatio^al liberties. 

The* years from 1932 to 19^8, broadly viewed, produced a great enlargement in the 
American public's acceptance of governmertt authority. This grew out of well- 
known developments — the need to end the Great Depression, install major social 
pro'grams to help the needy,' wage the Second World War and then the Cold War, carry 
out the an^eat Society programs of the 60's, and provide affirmative suppof^t to the 
race and sex equality revolutions. Most conservatives accepted those, parts of 
expanding 'government that supported business, defense, and overseas activity, while 
most liberals were enthusiastic about the new social programs, wi^th each expressing 
reservations over the other's basis for supporting enlarged government roles. 

However, since the late 1960's there Xas been a visibly growing public discontent 
'with and distrust of government in the United States, a sentiment well documented 
by careful opinion surveys. Conservative critics have attacked centralized Big 
'Government, urging a return of funds and decision-making to , the state and local -levels 
as well as using private rather than public programs wherever possible. Many liberals 
have become disillusion^'with the failures pf recent government programs to** have 
fundamental effects on' poverty, crime, bad education, drug^ rehabilitation, race 
inequitites, and similar problems. Within both ideological camps, „the shortage of 
viable government programs has also led to doubts about using legal coersion to 
collect and store extensive personal information, especially from "client population" 
— senior citizerfs ^on Social Security and Medicare; welfare recipients' children; 
persons in <}rug rehabilitation programs, etc, 
^ All 'Of this might have still .remained at "normal" levels of Ameri,Cjan distrtist 
about government had it not been for Watergate and its successor revelations. The 

,211 

o 



ERIC 



235 



Watergate disclosures of how top officials jof the federal executive branch abused 
Internal Revenue Service records," conducted, mail covers and openings, used illegal 
wiretapping and bugging, spied on political critics and dissident groups, and 
resorted to -burglaries and break-ins came as a shock ^o the American public. All the 
"what if" warnings of civil libertarians about possible misuse of government powers 
suddenly became real rather than hypothetical situations. As several leaders in the 
psychiatric professicn stated recently, "The break-in at Dr. Fielding's office to 
secure Daniel Ellsbe^'s p&ychiatric records was the last straw for us. From then on, 
we had to make protection of confidential records a top priority of our profession." 

Revelations since the Watergate disclosures of 1973-7^ have, if anything, deeper% 
public concern over the security of personal dat$i fr^m misuse. During 197^-76) 
documentation of admittedly illegal or improper surveillance activities by the F«BI, 
CIA, and IRS have convinced the average person that the label of "confidential" on 
any personal file held in government may be slender insurance against the efforts of 
federal, state or local investigators to get dnformation, either overtly through the 
"buddy, system" or by covert means, 

* V Thus the call for pe^rsonal data to carry out even the most laudatory government 
programs, managed by even the most soci^lly-minded and confidentiality-oriented 
professionals, must bear the burden now of the Watergate and post-Watergate revelations 
If this seems unfair to ^thoset government officials or proponents of social programs 
who were wholly outraged by Watergate, such are' likely to be, for some time, the 

^^'^ paipful consequences when the highest elected and sc^pointed officials in a nation are 
found to have betrayed the public • trust . " ' ^ 

Consumerism Bnters the Health^Caire Field 

Consumerism as a movement rests on two basic premises: that people have a right 
to be truthfully and fujly informed about the pro^iiicts and services offered for sale 
• to them, and that law should step in whenever commercial products or government 
activities present -a-Manger to public, health and safety.- Consumerism has joined hands 
W^th the civil right's movement over denial of credit or other commercial services to 
racial minorities or women, and it has found common cause with civil liberties groups 
^ over protect-ion of confidentiality and rights of access in areas such as credit 
reporting, customer bank records, and school and cdllege files. Medical records have 
often been part of these consumer/citizen rights campaigns, as with provisions deaOdng 
with medical records in the Buckley Amendment of 197^» the federal Privacy Act of 197^ 
.^aiUl parallel state faic information practices laws, and proposed amendments to add 
medical information in consumer reports to the coverage of the Fair Credit Reporting 
Act. 

The most common meeting grdund for consumerists and civil libertarians is the 
<iemand fof* individual access to records. Using medical records aVan example, the 
int^ests are common vfhen the issue is the right ot.a patient, when he or she .insists 
ujjbn it^^ to examine the primary medical record and to knbw about any o-fther uses made 
of it, ^The consumer's demand to know in order to make an informed "buyer's" decision 
about the hature, quality,. and consequences of health care matches the civil 
libertarian's insistence that access is vital to informed consent in the doctor-patient 
relationship and the securing of due process whenever an individual's secular rights 
or opportunities 'are determined through use of medical information. 
^ ^ 215 - 
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The Uncertainty of Law ' ^ 

As we noted in Part One, legal rules until recently have not been very clear and 
detailed on the key issues of privacy, confidentiality, and individual access raised 
by the growing use of health data in American society. Until the early 1970*s, case , 
law centered primarily on issues of testimonial privilege, and provisions for patient 
access usually arose only when malpractice . actions were involved. Many statutes 
stipulated that medical or health data collected under -their auspices were 
, ''confidential" but most did not specify what that promise meant, especially in, terms 
Qf controlling the release of identified records, to ^ third peirties for quality-care 
review, research, for law enforcement, under subpoeria, etc. There were virtually no 
statutes or court decisions setting limits as to whax medical data could be collected, 
or regulating which health data were proper anrd improper to use for making governmental 
•and social judgments. 

This situation began to change in the mid-1970's. Federal confidentiality 
statutes governing alcohol and drug abuse programs provided some' detailed protections'. 
The federal Privacy Act of 197^ and its counterpeirt in five states as of early I976 
provided important rules as to collection, use, and individual access to personal data 
in the hands^ of government agencies providing direct health care, conducting health 
research, or using health data to make evaluative decisions for employment, licensing, 
etc' Similarly, HEW's regfilati ons governing confidentiality and access in the 'new 
federal PSRO system were more explicit and protective than anything in earlier 
federal review procedures. 

Several things should be noted about' this situation. First, many^of the reactions 
to computerization of health data that we encountered and will analyze in this chapter 
took place before such new privacy laws had been enact*edj they arose under the , 
then-correct assuqiption by critics that there was no existing legislation to protect 
individual rights in the operations bf such data systems, A second point is that the^ , 
laws just mentioned are still new (the federal Privacy Act did not go into effect 
until September of 1975) and their effects are still uncertaini this* is all the 
more true for the health field becaus^^ the'se acts do not contain specific sections 
written to deal with the special problems of medical and health records. Finally, 
the entire private sector and ^5 of the states are not covered by general privacy 
legislation, leaving quite a gap in the structure of citizen protection. 

Thus the- first major encounters by health professionals and citizen rights groups 
with computerizing health-data systems arose .either before basic legal rights of 
patients and 'data subjects had been spelled out, or at a time when coverage of these 
acts for patient rights is still far from clear. As a result, various groups 
concerned over citizens^rights have remained distinctly uneasy about accepting 
computerization, of sensitive health data before rules and safeguards are fully 
. installed, ^ ^ ^ 

Popular Perceptions of '*The Comuuter" , 

When computers began to be used extensively in the mid-1960 "s to automate 
personal data files, much of the American public was fundamentally ignorant of what 
computers did and how. As a result of over-inflated claims of capability by 
computer en-^siasts and oyer-credulous acceptance of these predictions by persons 
worried about ci.tizen rights, much 'of the debate over "computers and privacy" 
^ ' 2i6 ' 
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in^the late 1960*s was based on faulty assumptions 'as to the '^computer 's real impact 
on data handling and' decision-making. 

This condition was rectified by the report of the National Academy of Sciences' 
Project on Computer Da^tabanks in 1972. The NAS study, to which we have already 
referred, explained and corrected several popular misconceptions about computer'^. 
It showed that computer use did not automatically lead organizations to collect more * 
intrusive information than they had collected manually? or to exchange data with 
different organizations than had been traditional, just because each had computers; 
or to be more secretive and provide fewer notice and access rights than the same 
brganization did^bef'ore it computerized. The NAS Report ^Iso showed that computers 
always respond to the explicit instructions of their owners as to how long to store 

, any piece of information, what signi/icance to place on any item, ^r what factors 
to aggregate in making a judgment a^out any person. In short, computers were shown 

, to follow 'the policy directions of human owners and programmers as set by 
organizationa; managers or by la^j they are not the "unforgiving, unf orgetting" 
automatons presented by much ojp* the anti-computer literature of the 196o''s, 

The NAS Report and other objective studies led most citizen groups, professional 
organizations, and political leaders in the mid-1970's to focus on the real citizen 
rights issues in record-keeping: whatever the medium of information storage and '"^^-t 
processing, what are the standards and procedures being adopted by organizational - 
managers to make judgments about people? Opinion studies also "showed that a . . 
majority of the public h^d acquired sensible judgments about many key issues of' 
computerization, for example, that most of the goofs and rigidities of computer 
operations are the result of insensitive human actions, which can be remedied at 
acceptable costs if the public refuses to accept such performances. Passage^, of the 
Fair Credit Billing Act of 1975 is an example of the public's determination that 
computer systems should be made responsive to people, and not vice versa. 

The importance of this for our purposes is that extensive computer use in health 
care arrived in the 1970's, after citizen rights groups, >the media, and "legislators ' 
had begun to acquire more sophisticated and accurate views of what computers can * 
and cannot do. It also came after the public had shown that it accepted the 
"privacy campaign" as a legitimate and important area for regulatory action, 

* * * 

Other forces and trends might be mentioned in describing the complex social ^ 
setting in which health computerization is taking place, and we have 'not tried to 
assemble here a comprehensive account, O^ir goal has been to note these developments 
that bear directly on citizens rights claims, and on that score,' we think the major 
points have been made. Computerization of health data is unf olding jji an atmosphere 
of considerable public mistrust over the motives, promises, practices, and ' 
performance of government agencies, mixed with a rapidly growing coi^sumerist approach 
to health care and growing public belief that privacy protections should be instituted 
by positive regulation before sensitive new data systems are implemented. 
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ANALYZING THE GOr^PUTER'S IMPACT ' 

Given the social setting thaf we have described, how can we analyze the 'impact 
thart: health-data computerization has had thus far on citizen rights? One important 
observation to start with is that instances of hairm done to individuals — violations 
of confidentiality, refusals of access, etc.— are still almost entirely centered today 
on manual rather than computerized files. This is because manual files are the 
places where most of our detailed medical and health records aire still bein^ kept. 
Furthermore, even when some patient records aire automated by Zone I providers, there 
is usually manual -re cord backup, photocopies, or computer printout floating around 
Somewhere in the organization, and this remains an easier tairget for attack, as by 
reporters trying to get information on celebrities in hospitals, than are the computer 
files. ^ Where record systems have been heavily computerized, as in the service payer 
organizations in Zon^<"^?^^^^he complaints that we noted have alsc arisen primsirily 
from employeea of payer organizations writing doctors and hospitals to provide more 
detailed (mEinual) information than the providers thought necessary and proper, or when 
leaks of patient data were made in manual reports to employers about their employees* 
health conditions. Similarly, most of the disputed social judgments about people being 
made by organizations in Zone III, on the basis of health data, are also still based 
today on msuiual records. i 

Secondly, as we examined automation of health data in Zones I and II, we noted 
that records in their cpmputer files are generally more subject to rules of restricted 
access than paper records located elsewhere in that institution or in ^milsir 
non-automated facilities. Pairtly, this is because protection of the computer, its 
programs, and its continuous operations leads to stricter . rules than are usually 
followed at nursing stations, record rooms, etc.i in this sense, privacy a^id 
confidentiality are serendipitous benef iciferies of computer security practices. 
However, we also noted that manysof the computer professionals and medical or health 
colleagues who lead computerization projects in the health field are sensitive to the 
civil liberties issues, since these have been so widely debated in the computer^ press 
over the past half dozen years. In addition, a set of general systems techniques for 
controlling authorizations- and access, maintaining audit trails, and taking 
protective measures over"" personal or proprietary data have been evolved and well 
publicized in the past few years, and these have been in'stalled in many of the systems 
that we visited or studied. Thus, making a gross, comparison as to the degree of 
protection given to confidential patient data ^n most highly automated systems 
compared^ to most comparable m'anual facilities, our judgment would be that the automated 
facilities are better protected today than most manual records against the kind of 
leakages and "nrrsuses that have been problems in recent decadeis, 

♦ What we conclude is that the main problem today in computerized health data 
systems is potential harm* As we will see,.what makes such potential harm particularly 
serious for civil liberties is the fact that these possibilities of misuse have not 
been taken into account and dealt with effectively by the managers of such 
computerized systems. 
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To develop this analysis, we will present- a series of incident., collected dur- 
• ing the two years of this project, involving the oj^gat ion or us e of poniputerized 
records. We will relate' what happen^^ sometimes ^^^ping several situations 
together, then offer' comments- on what the incidents suggest about computerization 
and citizen rights. 

Incident I The Missouri State Division of Health ^ 

In June of 197^, the State of Missouri '^Division of Health' ordered all Missouri 
hospitals, private as well as' public, to provide abstracts of patient discharge- data 
so that state health .officials, could "study the prevalence and control of disease in 
r/:issouri." The abstracts were to include: an abstract number, hospital number i 
jnedical record numbert year and date of birthj admission datai discharge datej sex» ' 
race, color, or originT marital' status i residence (by census tract, -zip code and 
street name)i discharge service, exp4cte?f^imary source of payment, Attending 
physician, discharge status, diagnosis, ^and surgical and diagnostic procedures used. 
Providing^ the patient's name was "optional" for the hospital. Failure to provide 
the abstract could lead to loss of the hospital's license to operate. 

The availrfility of computers was officially cited as the reason for launching 
the ntandatory data system in 197^^. Garland Land, director of the Missouri Center for 
Hefiajth Statistic?, explained that "the program has actually been in effect since 
196^ on a voluntary basis. ^ When the program was computerized to make it more 
efficient, 100 per cent of" the ^data was necessary and its release was made mandatory.- 
In addition to helping in the, study and control of disease, state authorities said 
the information Was^vitally needed for better, health planning and to av.oid the 
construction of unnecessary or^duplicative hospital facilities. 

These explanations, and the way the new system was to operate, did not convince 
everydpe.in Missouri. „ St. Mary's Hospital in Richmond Heights, Missouri, announced 
that it would refuse to supply the discharge data. Patient authorization is required .> 
fqp all information released, St. Mary's said, and government, agencies can'be given 
only aggregate data in the forrn^ of statistics. Robert Thebeau, assistant 'executive 
director of St. I^ary 's- explained that while" the stated objectives of-.the state ' 
program "sound -good, " the way the state went about these is "not sound." All the 
state needs -i^ statistical data, he declared, "but they want information about each 
patient . " • • 

<> , ' 

Director Land replied that statistical data "isn't i^efined enough and. presents 
limitations.^ Individualized data are needed because they are more easily analyzed. ^ 
But this doesn't mean, the data have to be personally identifiable. We -Oon't ask for 
patients' names." State officials also-noted that the June 197'+ directive made " 
provision for prqtecting pktient privacy. A clause in the collect'iori order stated, 



225-346 0 - 76 - 16 



ERIC 



"Any contemplated di«emination by the Missouri Division of Health of the data 
originally procured from a^ospital and which contains evidence >^hich might identify 
any individual person, hospital or physician can be ceirried out only with written 
permission of the hospital,** 

♦These assurances still did not satisfy .off icials of the Sisters of ^t, Maury's, 
RosaAie Mer«-, m^aiTal" fiords administrator, saijf that once patient information is 
^ivein to the state "ther4 is no way we know it can be secure. There is no foolproof 
data processing storage ^ystem, " Kr,'Thebeau added that Missouri's "Sunshine Law" 
opens all state information not expressly exempted to public access, and there was 

r * ' 

no assurance that these r€bords were exempt. 

To deal with the thi*eat jthey saw posed by the state data system, St, Maury's 

officials helped form the Eastern Missouri Task Force for Health Data Security, a 

'group composed of hospital executives^, medical record administrators, physicians, 

nurses, computer .programmers, and systems analysts working in the hospital field. In 

its communication with the state health division the Task Force stressed th&t it 

"does not question the need for comparable health data," However, "as a matter of 

professional ethics," Task Force members said, "we cainnot submit clinical data to 

.this data bank, or any other "Hata bank, uTrtTr"We^have been assiJred .that adequate 

safeguards have .been built into the system," In addition to asking that protective 

rules be spelled out dealing with confidentiality and data security in the proposed 

system, tfie Task Force suggested that such data ought to be maintained in special 

Ethical Data Centers, a new set of institutions operating under formal codes of 

professional conduct, "with explicit and appropriate operational stsmdards, with 

clearly defined data access policies, and wi'th stringent and continuing data security 

measures to ensure medical ponf idehtiality , " (The Ethical Data Center concept has 

been pioneered by Dr,^^lmer Gabrieli of the E,J, Meyer Hospital, Buffalo, New York.) 

'3y June of 197^,' leaders of the St, Louis County Medica?l Sbciety'' had joined ^in 

the opposition to the state's data plan. The Society's "Legislative Column," written 

by Dr, Edwin J, Ciinninghani, noted that the items of patient identification to be 

collected, even though they c^id not include name, would be enough to make 

identification of individuals "a simple matter." "In addition, th e att ending physician 

would have an identifiable number that would easily identify^him and gain $icoess to 

Confidential information," Dr, Cunningham went on to report: 

The Ad Hoc Committee o'f the County Society regarding PSRO discussed 
this proposal in detail with several other guests recently. It was the 
feeling of the committee that since the need for this information and the,, 
^ authority to acquire it has not been clearly established, that^we oppose 
such a proposal at this point. In addition, the utilization, distribution, 
and access to this confidential information is also unclear which poseS; a 
severe .threat tq confidentiality ^ 

Any legitimate-^data ^requested by the Missouri State Health Department 
can be. niet by currently operative mechanisms that insure that confidentiality 
is preserved. 

In addition, Dr, Robert Deitchman wrote a scathing. attack in the Medical Society 

Bulletin calling on doctors to rally the public against the state's proposal: ♦ 

Confidentiality — one of the keystones to the patient-doctor relationship 
willjsbeconte a hollow word — a faurce — if the state health organization 
cortinues with its oii-5;oinf^ plans ^ computerize all discharge information 
from the hospitals,... , * , - 

• r * 
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Despite crude and sparse material requested, a person with some^ knQW ledge 
can sift through the computer, checking out a specific person, pinning him 
down by a^e, address, date or discharge, and census block, to pinpoint any 
individual they see — and use it as they wish — regardless of today's promise 
it will all be done in desire for research and statistics,,,,' 

For the doctor this is a "real threat to his oath as. a doctor — but the ^' 
public — they n6ed to be warned, alerted, awakened to the silent death'of 
their privacy amid the slowly turning hum of the computer and bureaucracy . ^ ' 

As opposition mounted, the fask Force directed another attack on the failure of 
the state health division to involve the med5,cal profession, the betr, and compu"^pr 
experts before it ordered the project to proceed. 

In November of 197^» the Attorney General of Missouri was asked to rule on the 
legality of the sta.te division order. Before he could do so, however, the state 
healtsh division announced in December of 19?^ that it had reconsidered its order. 
The provision of discharge abstracts, it said, "will continue to be voluntary." 

• Comment 

This episode- contains several different elements typical of those that arise 
alone: with computerization: (1) the change from voluntary to mandatory compliance 
was dictated because the computer made processing of the information possible; 
(2) the need for the computerization of identified patient data for the purpose' of 
hospital planning, evaluation and utilization review was not balanced convincingly 
against the rights of confidentiality of the patients; critics pointed out that 
the same socially useful goals could be, carried out with unidentified statistical 
data; (J3) the proposal to computerize identified data was not accompani-ed by any 
plan, draft legislation ^ ^ or regulation to prevent dissemination of identified datar 
a mere pledge that dissemination of patient inf ormation^would require ^rmission of " 
the h^pital raised^ more questiqrts than it answered, and no'attempt wts made to secure 
le^jal protection of the records from the operations of Missouri's public information; 
(4) special concerns were raised because of the possibility that once the 4&tai was 
in the state health divisions* computer files, it might be sought by other state 
heal'th or welfare agencies with automated systems, or,- be demanded by federal officials 
administering federal health programs. - 

Several markedly/ Simifar incidents have occurred in other states; we will look at 
three together. 

Incident I The !Vichifi:an Dep^lftment of !v:ental Health ^ ' ^ 

In the fall of 1972, Dr. Gordon Yudashkin, Director of the Michigan Department 
of Mental Health, announced that a detailed "face sheet" rep6rt would be required on 
all persons beinr: treated by local mental health agencies as a condition of^ continued 
state funding of their activities. 'These would go into a, state computer file, where 
they would be used. Dr. Yudashkin stated, "to evaluate whether the poor and the 
really sick are being helped" and to facilitate the treatment of more people outside 
institutions. Opposition to the compulsory reports was immediately voiced by mental., 
health agencies and the state ACLU chapter. A lawsuit in state court to enjoin the 
pro^^ram was filed by the Michigan Society for Mental Health and the Shiawassee 
Community Health Board, alleging that disclosure of extensive persoi^al and diagnostic" ' 
information, stored. by name, violated doctor-patient confidentiality and improperly ' 
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invacfbd the patient's privacy, 

pr* Yudashkin replaced that "the new system gives more privacy than, the old one," 
under which Michigan's 50 state clinics had kept records by patient name for over 3Q . 
years^ Under the plan to computerize data from the county mental health group, a 
**name code" is used based on every other letter of the name, and this protects 
confidentiality* 

The complaining groups were not convinced that requiring the name was necessary 
for the state's evaluative needs,' or that using the code procedure was a sufficient 
safeguard, , i 

The initial court decision upheld the state, but while an appeal'^was being 
prepared, Dr» Yudashkin announced that* the state could do its work well enough without 
names being furnished with face sheets and that he was rescinding the requirement for 
furnishing names; * ■ V'' 

Incidents The Washington Department, or Social and Health Services,^ 

In the state of iVashington in 1972, the^ ACLU had pre paired the papers for a lawsuit 
again sj^ he King County (Seattle) Community Mental Health Service, to eiTjoin its 
direc-M^from furnishing the state's Depairtmen't of Social and^alth Services with 
identified patient case inf oripation , The state had ordered that this information be 
furnished by all private and community institutions receiving state or federal funds 
through the county mental health service. The plan wa^ to create a central computer 
file in the state capitol> as part of the Department's Community Mental Health 
Information System. * " ' . 

The data that ^vas to be furnished included identification information (social 
security number, bir.thdate, sex, mairital status, ethnic origin, monthly family income, 
etcOi'the diagnosis (by the American Psychiatric Association's diagnosis code); the 
type of activity used ^s therapy or treatment; who referred the person or group there; 
an evaluation of the probl^ems the individual has with respect to job, school, home, 
family, thought process, emotion, mairital, drug, or alcohol; and an identification by 
name and discipline of who made the diagnosis and evaluSLtion. " An 'additionai report 
was ^ be required for each further contact with the center or agency after the initial 
report. r ' ' — - . ^ . >^ ^ ^ 

The ACUI suit a^raxnst the plan was brought' by two psychiatirists working on a 
contract basis with local mental health centers and by the director of the Jewish 
Family ^and^^Child Service, alleging that compliance would require them to violate the 
rights, to privacy and medical confidentiality of their patients. The suit called on 
the staite to '^devise a data system where records cannot be ascribed to individual 
patients." 

Before the suit; was filed, an agreement was worked ouJ^,with ^the state Attorney 
General providi-n^r^that more limited statistical data,' and without personal identifiers, 
would be alL that local agencies had, to submit to the state. 

Incident t wThe New Vork. State Depairtment tpf Mental Hygiene^ • 

No sucn neigotiated settlement has bien reached in .a case currently being litigated 
in New York. In November of 1973» the state Department qf Mental Hygiene promulgated a 
reporting form (known as the "M?-5**) to be completed on each psychiatric outpatient by 



mental health institutions and sent to Albaf^>W^ere its contents would be placed in 
the Department's computer system* The WS-S includes the patient's name, social 
security number, extensive personal information, problem appraisal, problem severity 
rating, and oth^r sensitive data. These include; "social relations disturbalnce , •* 
"social performance disturbance," and a list of 24 "other signs*and symgtojBs" such as 
"suicidal thoughts," "grandiosity," "sexual problems," "anti-social attitudes," 
"narcptics," and "delusions," ^ 

The IVental Health Law "Project was approached in late 1973 by several doctors and- 
patien,ts at the Tremont Crisis Center of Bronx Hospital, New York City, who objected 
to such identified forms being sent to the State Commissioner of Mental Hygiene and 
computerized in a state file, A lawsuit was filed on behalf of three doctors at the 
Center, three patients-* and a social worker. 

The suit alleges that the data-collection is "anti-therapeutic" since it would, 
when patierhjs learn about it, deter some prospective patients from seeking .tre^ment 
at the Centejr or lead present patients not to disclose sensitive information fully, 
thereby interfering with the professional activities of docfors and social workers. 
The suit states that the disclosures are in violation of the doctor-patient and social 
worker-clien|t privileges gf New York law; provisions o'j^the state Mental "Hygiene Law 
("Names of patients treated at outpatient or non-residential facilities and at general 
hospitals shall not be required."); and of the patient's "constitutional rights to 
privacy, duej process, and ^^qual protection of the law." 

The stjit also chaii'l^^d the degree of confidentiality that the data would have t 

The degree to wSlch the information is kept confidential by the 
Department of MentalMygiene is open to question. There is som6 indication 
that any doctor or ^loyee of any state facility can obtain the information 
on any patient in Xx^ state simply by dialing a -specific telephone number 
and requesting the i^ormation. By law *the information is available to any 
court of record^ th<^ental Health Information Service (the legal advocacy #^ 
system in New York) ,|knyone receiving the consent of the Commissioner and 
of the patient, and yith the sole consent of the Commissioner to any 
agencies which make payments on behalf of the patients, such as Medicare 
or Medicaid, missing persons agencies, criminal agencies, and the Firearms 
Control-^Board of the City of New York. ' 

The suit asked that the MS-5 form be held illegal, or if that were not accepted, 
that patient data be kept only by number in the central computer and th^ links 
between number and patient- name be kept only by the local facility. 

However, the lower c^\^^upheld the Commissioner at the initial h^arin^, 
dismissing the suit on thre grounds that the^S-5 represented a reasonable exercise 
of th6 State's powers, An appeal is now pending. 

\ 

Comment 

• If — 

The three episo^ above are similar to the first one (Missouri) in their basic 
outlines; the 2U*rival of a computei' stimulating the collection of buch datu; the lack 
of a demonstrated need for identified data for evaluative purposes; and the lack of 
accompanying legislation or regulations to safeguard identified .data. The 
variations occur in • the amount of detail required. Both the Washington and New-York f,-^ 
r^pol^ting forms go far beyond the identification-payer-diagnosis type of information ^ 
requested by the first two agencies; they require submission of the most sensitive 
data about each patient. Even if a need could be demonstrated for the collection 
of somfe identified patient data for evaluative purposes, therefore, questions would* 
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still be raised as to how much and what kinds of data ought to be collected for 
such purposes. In addition, the law suit brought against the MS-5 form in New York 
f opuses on the lack of confidentiality of the material, pointing out that by law 
t^ie information would be available to courts, to service payers, to missing persons 
bureaus, and law enforcement agencies. 

It is^ also worth noting that in three of the four episodes, the organized 
protests of professional groups or civil liberties organizations resulted in the 
projects either being abandoned or' modified to take at least some of the citizefis 
rights demands into account. The episodes also illustrate the tendency of many 



^ovelrnment agencies to plan and implement n^^automated data systems without * 
providing nbtice. to the population to be affected, professional gi^pups, citizens* 
organizations, or to the public at large. Even where formal notices may be issued, 
there is often a practice not to hold meaningful sconsultations with interested groups 
or Dublic hearings in advance of instituting such sys]tems. ^ 

An example of this was reported in January of 1976 by Alan Taylor^ a columnist 
for Computerworld who writps often about problems of making comput^ systems 
responsive to the people they are created to serve. Taylor relate|^that the State of 
Maryland's Health ServicBS Cost Review Commission published a brief ^notice ir! 
December of 1975 iJ^ the obscure Maryland Register announcing that it would require 
all hospitals to furnish each patient's Social Security numbet', the number of his/her 
"legally responsible** doctor or surgeon, and a list of detailed items of medical 
information. The hospitals affected received no explanations, nor wetre patients 
informed of what would be done with the data. No public hearings were scheduled to 
discuss the^ reporting system, which was to go into effect in April ,of 1976. At a 
meetine: in January, 1976 of the Baltimore and Washington, D.C. Data Processing Medical 
Users Group, it was found that computer specialists in Marylaind hospitals were 
unaware of the plan. By calling the Commission, Taylor was able to leairn that the 
Commission intended to send the material to the U.S. National Institutes of Health, 
but little else was communicated. Taylor deplored this style of creating data banks 
with highly sensitive personal information, and urged that the Marylsind Commits Ton 
delay its data base implementation until^'i.nf ormation is released and reviewed by an 
mpartial authority and by the public." ''^ ' 

Incident! The California Community Services Division 

^ ,In £ffi<effort to reduce costs and control eligibility standards for welfare 
recipients, the state of California computerized its welfare -rolls and required local 
welfare offices to submit detailed reports on each^client. The data to be furnished 
included' reports as to the un^pioyability of individuals due ttf mental disability 
or the presence of mental illness, alcoholism, drug or nsircotic dependency, sex 
offender status, mental retardation, unwed mother, unwed pregnancy, "mentally 
Incapable of personal n)oney. management, ai>d other conditionsr-some medical and some 
non-medical.-^ ' ^ ^ 

In 1969 • two psychiatric social workers assigned to the San Fjrancisco office of 
the staf^e Communit^'^S.ervice Division refused to^ comply' with the requirement to submit 
these reports. t*^ ' " « 

* 

Si 

? * * 
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They maintained that furnishing such data on their clients to^^;WT^'Ttrte, for 
use in a computer system open to many unknown uses, would breach the coif identiality 
of the social worker-client relationship, their professional code* of ethics to keep 
such information confidential, and the privacy rights of their clients, , The State - 
rejected the social workers* protest, and ordered them suspended^ and their pay 
forfeited for five days for "willful disobedience" of Department orders. The 
r^orthe-pn California ACLU defended the two social workers, in an appeal from this 
action,' contending that the state welfare department's 'computer system was 
insufficiently secure in its confidentiality and security protections, thus 
justifying the sociallSbrkers • refusal to submit the sensitive psychiatric and 
emotJ.«^l data on their clients, * ' 

This position was rejected by the California courts at the trial and appellate 
court levels, A 197^ Appelate Court opinion ' held that the social workers had no' 
psychiatrist's privilege under California law, that welfare client data is open to 
administrators of the welfare system, that collection of case data is essential to 
administration of the welfare pro-am, that welfare clients are not, entitled to 
notice nor is their consent required for inclusion of all their data in such a state o 
computer system, that it was the Department's responsibility to see that the 
confidentiality provisions of the state welfare code were^^net in their management 
of the computerized system,, and therefore that no right of privacy of the clients' or 
privilege of the caseworkers had been violated. The five-day suspensions were 
thereby upheld.^ ' * 

< Incident ; The //ashington State Depsirtment of Social and Health Services ^ 

In January of 1976, 200 caseworkers in the Washington State Department of Social ^ 
and Health Services filed grievances protesting an order to supply the Department's 
computerized reporting system with extensive personal information on welfare clients,. 
The state said these client reports were compulsory under Title 20 of the Social 
Security Act, as amended in 1975. which provides funds for the state's welfare ^ 
system, 'The state welfare workers said that' the n^w forms called for^ information 
in excess of what the federal law requires, jthat providing the information (which 
included physical and mental health data) would violate the confidentiality of the 
caseworker-client relationship, that the data coding required by the form produced 

► "de-humaLiiizing" categorization of individual situations ,^^and*that there, were 

insufficient controls over the uses that would be made of the personal information 

and who would Have access to it once it left the welfare agency's own ifMes, ^ 

The state welfare department rejected the positions of the protesting case- 
workers, and one woman with 15 years in the agency was fired for refusing to subrrtlt 
her client's data. The jase workers who filed the grievances have been supported 
by their union, the American Federati^on of State, County, and Municipal Employees, 
and a lawsuit to block the- reporting requirements has been threatened, with-^local 
civil liberties support, if the state does not modify its requirement. , - 



Comment , 



The common elemertt here wi-th the episode^' described earlier is the concern 
Qver leakage of- sensil^ive data to other gpvernment agencies, or over insecurely 
protected data systems,* But th6 main purpose '^f California's computerization of 
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welfare records i^ different from tfie computerization in the previous examples and 
raises another difficult question. In the previous, examples, a compelling case could 
be made that identified glata was not necessary to do program evaluation and ^ ^ 
utilization studies. But where the goal is welfare eligibility, identified da-^a is 
obviously essential. If one aQcepts the proposition that the government has the 
ri?cht to impose and enforce welfare eligibility standards — a proposition that neitjie 
society nor IThe law setiously questions— then the issul^becQines not whether or not 
to collect identified data, but how much and under what circumstances. Thus, the 
courts have^^uled that in determining welfare eligibil^ity the state may legitimately 
inquire as to how many members are in an applitf^t fa,in,ily and what their incomes are* 
However, t};e state may not conduct surpr^ise nighttime visits to^ an applicant family 
to discover whether t^ere is an "unauthorized" man living in the house (who might 
be supplying: unreported income) , since such /isit^ violate ^constitutional rights to* 
privacy. ' ^ • - ^ 

ThuS9 the questions raised by the' California incident are: (a) v;hat l^tsits 
shouH be set to assure that the information requested is relevant to the stated 
^purpose in this case, welfare eligibility?; (b) Should these limits bar the 
collection of sensitive psychiatric and emotional data, especially in view of the 
fact that such data might be made available to other state agencies, especially law 
'enforcement offifiials?; ^c) Do clients have tl^e right to know that inf9rmation 
confided to a social workeV wHl^iae^ forwarded to a central computer, and possibly 
be made available to other state agencies?' * . i , • 

Problem: Juvenile riecords , ' 
Juvenile records kept by both police departments and juvenile courts raise 
special problqms because of the anomalous position of juveniles in our criminal 
iustice system. Both the police and the courts assume responsibility for juveniles 
in cases where no criminal behavior is suspected or charged — runaways,* -truants, 
neglected children, psychologically troubled children, etc. ^^any states -and large ' 
metrop9litan areas "keep extensive computerized records on such children, which 
includes educational, medical, and family background information, Moreover, many 
juveniles run afoul of the law, and are even taken into custody for behavior which 
in an adult would^ not be Considered an offense. In New York C^ty,. for example, 
the Police Department maintains a computerized file for almost every- minor who 
encounters the police tabout 60,000 a- year) , and^iles a YD (Yoatli Division) card for 
each, A ^tudy conducted by the city's' Criminal Justice Coordinating Council* 
concluded that nearly half of the YD cards were filed for such acts as "loudness, ^ 
boisterousness, , ,use of obscene language, annoying people^ throwing objects.,,--^ 
shimming, eto,,," In approximately kOfo of these cases, the study .found ,^ there is no 
checkr ^n the validity of the initial decision to classify the^ behavior as an offense, 
YD cards are filed for the .victims of offenses, althoti^h there is no evidence of 
immrope r^e hav i or on the part of 'the victims. When a'youth is innocently involved, 
or/when tbe initial issuance of * a YD card is ur\authorized, the offense report remains. 
i(i the data banks, ' ^ 

Despite, such shortcomings,' the study found *the *YD record to be a major 
determinant in the disposition of subsequent charges* Minprs with three or four*, 
entries on their^'^YD cards were mu6h less likely to^jqualif^ for praba:ti<fn 'or t^o ^ 
have theij cases dismissed^ than those with no record, no matter what the^ seriousness 



or relevance of the particular entry. Length, not content, appeared to matter most. 

A ^number of states^Aave computerized juvenile court files, and the materials \ 
submitted to them are taken from the forms used by counselors y/ho interview juveniles 
in^connection with 4iivenile court proceedings, * The -^^U has raised two questl.ons 
ab6ut these forms, 9 piWr-€he boxes to be cheoked include such terms as "schizoid." 
"Latently psychotic," and similar brief descriptions, "Instead of a complex 

diagnosis which any^ one of ^hese conditions would- merit, ^the-AeLU-pro;jec1r-^n - 

Privacy and Data Collection recently noted, "the diagnosis is reduced to one word so 
that it can be easily computerized," The second concern^ is that the terms call for 
professional diagnoses, bit 'the counselors are not medical doctors or psychiatrists, 
The ^CLU goes on to state that though the juvenile or his/her representative may not 
see these labels, they ^;e accessible not only to juvenile c6urt personnel, but also 
"researchers, the FBI, the>rrt4itary and prospective employers,,," 



Comment 



Previous episodes have? raided the question of the need for identified patient 
information^to be collected at all, and where the need for identified information's 
demonstrated, the amount of data that should appropriately be collected. That ' 
question is raised in a most striking w^y by the New York YD system (and many other 
metropolitan police juvenile division practices) bqoause the collection of this 
non-criminal information, much of it containing sensitive psycholoAcal data, c^n-^ 
lead to criminal penalties, • 7^ j/' 

The question raised by computerized court records is the form in wM^c^he data 



be collected! that is,* does the short hand term^ostered by' computer coding 



distort the diagnosis, even if it is an accurate one? Should such diagnoses be used 
when made by a non-prof ess'lonal? 

These questions are-* of particular importance because of society's policy 
*\t6wards juveniles. For these children whose * "of fenses"' do not^lead to' court action, 

- but are kept on police indexes such as the New York YD index, there is no protection 
against' j:hex-r records being exchanged -with other police departments or private 
employers, In^ describing the Oranga County,^ California Central Juvenile Index 
lawyers who defend juveniles say "The Central JuWcl^ Index- is like a sieve. Every 
(fepartinent store and every insurance compaiiy hir^ moonlighting cops and excops,,, 
because they or their buddies have access to the i^ecords', . , " 

On the other hand, disclosure and recording of sensitive juvenile court record^^ 
is encouraged because of th^ widespread belief that juvenile W-ec ords arfe eitl^et 
.expunged or permanently sealed aft^r a period of years, and. tfveref or^hat th^ I 
information in them will not be available to cipher government I2enc/es^ or private 

c organizations. Indeed,^ both the federal Youthful Offender Act aJjd^nost 'state 

juvenile laws provide for this. But in^fact,' when juvenile arpests and/or ' ^ 

' convictions are reported^o the\P'BI, they are not specialLjjTt^estered, but are 
placed in ^the -regular criminal files and made availgLbl^ to any "authorized ""agency 
which requests them. Authorized agencies include not only state and local law 
er^l^rcement agencies, but licensing bureaus, the Civil Service CommissibA and other ^ 
government employers; private banks -and other non-la"W-enforcement organizations. 

'^Thus, in spite of protective juvenile expungement and sealing laws, juvenile records 
are almost as widely disseminated as those of adults who have been arrested or 
convicted, " . . ^s 
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Tncident: The IV'aryland Data System for the Handicapped ^^ 

In 1971, six Mairyland state agencies — Education, Juvenil5 Servipes, Welfare, ' 
Retardation, Mental Health and Preventive Medicine — coml)ined forces to contribute 
identified data on all handicapped children to a central computer file , Handicap 
was defined to include not only physical problems such as hearing and vision 
disorders, but "personality disorder," **major affective disorder,/* "sexual deviation. 



y 

^n(J--ad5ustm^n^t 'reaction." About lOfo of-th-e" suh^ol age population was~expected to be ' 
covered. One of the ways in , which thQ data was to be collected was by distributing 
forms to public school teachers who would be asked* to f ill , them in for .each child in 
whom they .obsersij{ed one of the listed problems, The^matter first came to the attention 
of civil liberies groups when several Prince Georges County teachers, refuse^to fill 
'in the form because they felt*they were not qualified to make medical or psychiatric 
.lud^ents . ' ^ 

The Data Sy&tem for the Handicapped (DSH) was intended, state officials said, 
to collect data from the participating state agenci^rs ^jTor research puF-ppses only. 
One state official seated that^t would help the state determine what resources 
needed to be allocated to special facilities for the eduoation handicapped 
children* ^ 

Orifi:inally, the ^CLU of {Maryland was a member- of a Parent Interest Group 
Advispry^ Committee for the DSH system. However, it withdraw from that committee, in 
197^' because^" if concluded that the system as it was set up was not dealing adequately 
with the privacy and 6onf identiality problems involved. I,t charged that the system 
did not prcJTl^e^parental notification or reviev* of the ^record created bn a child; did' 
not consider the ri^ht of minors to control th^ decisions themselves <rather tTian 
parents) where the minors are of suff ipient agej did not assure, periodic updating of 
records;* did not secure parental consent to inter^agenc^ exchange of records; and 
had not developed methods'to compile the statistical' data desired without placing 
names or other unique identifiers in the central file^ Noting tha^ it had received' 
dozens of complaints from parents and professional groups about the system, and *that 
"improper labelling" seemed to be an integf^al part of the operation; the ACLU called 
upon the sta\e to harlt operation of the DSH system until proper stan^ds and • 
procedures Irad been developed » - ^ ^ 

The state responded to the ACIU (and to the protests of, several^ counties), by 
anfiouncing^ that it was going to file records /fnly ^by a' code number, not by name; 
that data Would not be furnished to outside agencies, and ^t hat ccjisent and access 'was 
not relevant since dnly^stat istical uiSes were intended. They also promised- to 
re-exaraifi€ their labels, and to consider creating more precise categories. 4^ These 
were valuable changes, but ±he ACLU of Maryland still, considers the EiSH system to be 
insufficient in its safeguards. ' ^ k 

» * 

Comment ' , • . * 

V The problems here are three that wajiav« p/eviously identified: (1) the concefn 
over later inter-agency interchange; (2) thfe short-hand- ^;erms to fac-ilitate 
computerization which may dibtort the meaning of the feagno^is; and (3) the 
collection of medical tlata by individuals "Who are not qugiif ied •to make medical 
jud^ents: There is, however, an accompanying societal problem to whi^ch we have' 
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already 'alluded at several places in /the report, that computerization of identified 
medical records is declared necessary to provide a desirable benefit to the 
jlndividiials about whom the information is being gathered—in this case, to provide 
resources for the education of handicapped children - but such a benefit is not 
forthcoming, at least no"^ yet in Maryland. 



~ Tncidenti The 7^aryland ' Stat6 Abortion Surveillance Unit 

Tn^ Maryland^ the State ^bortion Surveillance Unit, part of the state Center for 
Health Statistics, Began in I966 collecting data on women having abortions in the 
state, for "descriptive, planning, and evaluation purposes." I968 was the year that 
Maryland law was liberalized to permit abortions for mental as well hs physical 
health reasons, and the state decided that keeping statistical data on the number 
of abortions, the a^ep and demographic characr'teristics of the womerr>^^etc . was a 
major new concern for health analysts. This belief ' was strengthened when abortions 
*in/aryland went up , substantially , following the 1972 Supreme Court decision striking 
down restrictive state anti-abortion laws. 

However, the activities of the Abortion Surveillance Unit drew heavy fire in 
197k from the National Organization of Women, the Childre.n's Defense Fund, and the 
W^aryland ACLU. Representatives from these groups noted that while the name is not 
included on ^.the form issued by the Unit, it did require the patient's block number 
address and Ji,ospital case number (which was often the patient's social security 
number), and 'patients were not informed of or asked to agre^ to the* sending of their 
data to the state Unit by doctors and health insti^tutions . "These files are there §0 
that at any time someone could make an administrative decision to share the 
information with another agency," said J.B. Dillingham, of the Children's. Defense 
Fund* Tn addition, critics noted<.that many women felt quite uneasy about the idea 
that a state file kept a permanent record of their abortions. The form also"- 
included .the notatioit whether the reason for the abortion was "elective, physical 
health, mental health, rape, congenital defect, or other," which was al^o considered 
an intrusive element about the patient to be kept in the state system. 

* . Dr. Frances Warthen, director of Maryland's Center for Health Statistics, 
defended the program as one ^that was necessary because hospitals prior to .the 
surveillance-report requirement often submitted "incomplete" yearly tabulfttions\' 
She also explained that the^block number and hospital case number were not entered 
j.nto the computerized file; the block plumber was used-, only to glade the case -within 
a given census tract for statistical repori^g, and the hospital number was obtained 
"should the facility neeid „to be contacted for more information about a particular 
patient." 

These explanations — especially the vagueness as to future^ uses of the hospital, • 
number— did not satisfy the critics. After consulting with them. Dr. Warthen .agreed- 
that the blook adjdress and patient* identification number would be crossed off \he 
form once the information was .fed into the computer; In that way, she said, "there 
are no identifiers on any tape *that also contains medical informatics . " Protest 
over this activity still continues, however.' 



Incident: The New York City Petal Death Registry ■ ^ 

In ^ew York City, a test case by a physician and his patient, supported by the 
New York Civil Liberties Union, led to a lower coMrt ruling in 1972 artriking down a 
city requirement that the name and address of, the patient be provided to the city 
fetal death registry by the physician in ail, cases of medical abortions. The 
patent complained 'that furnishing her name and address^ invaded her privacy by 
intruding into one of the most intensely personal aspects of a woman's lii)ej it also 
forced the physician to breach a confidential communication. The court observed"* 
that there was no statutory direction that the name and address be put into the 
registry, and no proof made out that the city needed this for statistical and public? 
health purposft4, yet the requirement had the effect of jeopairdizing the state's 
liberalized abortion policie^s. The court held that compelling disclosure of name 
*and address was "arbitrary and capricious," an "unlawfi^l invasion" of the patient's 
ri^rht to privacy, and an/improper interference with the "clearly cherished right of 
absolute confidentiality of a physician-patient relationship,"^^ 

In December of 19y5f the r^w York CfOurt of Appeals reversed that ruling in a' 
^-3 decision that upheld the city's power to require physicians to report the names 
and addresses' of all women receiving ab^t4ons to the central fetal death registry, 
The majority found proper and "laudable" the city's purpose;s to monitor procedures, 
facilitate follow-up/ of complications, track possible adverse effects of abortions, 
and offer family co\4nseling. The fact that the U,S, Supreme Court had upheld the' 
constitutional power of states to adopt regulations for abortions during the Second 
trimester of pre pi ancy was considered support for *the city's'action. In the absence 
of any alle^cat ions* that the information was being used improperly or being 
disseminated for other purposes, the majority said that there was no infringement 
on the ri^ht to abj^tion or of the patient's right to privacy. 

The dissenters felt that "the ri^ht to privacy which the Supreme t)ourt extended 
to a woman's deaisi9n to "abort necessarily ext^ds an^, includes ^her right to . 
^^uard her identity from a centralized abortion ^gistry," They noted ^hat all the 
purposes sous^ht by the city could be accomplj^shed by ^using .either files in the 
hospitals ot statistical reporting to the re^istf-y. The case is now being appealed 
to the ^U.S. Supreme Court. ' " 

Problem! Child Abuse Registries . | ' • 

One area in which the central registry idea has taken hold with particuj.ar 
.firmness in the past decade is child abuse. In I966, only four .states had central 
re^risters to/which instances of child abuse- were reported;* by 1974, 30 states had 
pasffed laws/requirinr such\registers (in varying forms) and many local governments 
had enactej^ them a§ well. The laws 'generally require doctors, hospitals, school 
officials, welfare officials, and other professional groups 'to report wounds and ^ 
in .juries sustained by Children, Some of the registries allow any individual who 
wishes to volunteer a. report of child abuse. During the past few years, while 
approving: the general purpose of protectin.^ abused children, civil liberties and 
other citizens ^rroups have opposed ^afts of such child abuse registery laws in 
some states when the'se lacked sufficient plrovision for due process hearings before 
adults were"~listed as child abusers; when the system could lead to "potential 
blackmail?" when case reports that might be based on shaky evidence would be 
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available to various pul)lic officials such as the police, welfare administrators 

etc; and when "a permanent computer file of an alleged child abuser could follow 

him around all the rest of his life." In several cases, protests by civil liberties 

ficroup^ resulted In the enlargement of safeguards in the enabling legislation, and 

were then enacted, . . _j - 

Problem: Drug Prescription Registries 

During the Qarly 1970's, many states enacted laws requiring dispensing physicians 
or pharmacists to send the state a form_ whenever they dispensed certain drugs having 
"hierh potential for abusi?." The specified drugs included not only morphine and 
codeine but also ritalin, percodan, and hucodanj these drugs are widely used in . \ 
treatment of obesity, hi^h blood pressure, hyperkinetic children, epilepsy, migraine 
headaches, and other "regular" medical problems. The compulsory report includes the 
name and address of^the patient. 

New York enacted such a law in^l973» and set up a computerized "controlled 
drugs" refristry in Albany maintained by the 3tate Bureau of Controlled Substances. 
Licensing, and Evaluation. The registry's purpose, according to the State, was to 
identify person's who obtained multiple prescriptions or received more than a 30 day 
supply of these drugs. After 20 -months of operation, the registry had about two 
million prescriptions recorded. 

Several groups in New York— the Empi^TP State Physicians Guild, the Legal Action 
Center,* and the New York Civil Liberties Union— brought suit in federal court to have 
the registry law declared unconstitutional. A federal court of appeals held it 
unconstitutional in 1975 as an unjustified irvvasion of the privacy of the doctor- 
patient relationship.^"^ At the court hearing, several patietits testified that they 
stopped taking the designated medicines when they learned, that they were being 
recorded in the, state registry:^ » ~ _ . ' . • 

"A cancer patient using percodan for pain stopped taking the' - 
drug when he learned of the registration. He tried other drugs ^which 
did not relieve his suffering, and now orders the drug through his 
union from sources outsi.de the state." 

•'Another patient said she had used a medication containing codeine \ 
for migrair^e head^^ches, but when she learned that her name would be 
reported to Albany and put on a computer, she stopped the medication." , - 

;*A woman whose child suffered'from hyperkinesia took the child off 
, ritalin rather tha^' have him 'branded for life* as a drug user." 

- * The court said the" issue was a "troublesome" one, since the state was trying to. 

deal with the v^ery real problems of drug abuse. However, the court noted that 'only ' 
one person going from doctor to doctor for prescriptions had been found in 20 montJisi , 
to compile a data base of over Z million personally identified prescriptions for such 

^ % results, the 'court said, was "too high" a price "in diftiunition of^ freedom." , 
"An individual's. physical ills and disabilities, the medication he takes^ the 
frequency of his medical consultation are among the most sensitive of personal and 
psychological sensibilities. . ". .One does not normally expect to h*ave to reveal .to-^'a * 
governmental source these facets of one's life. 'One is wont to feel that this is 
nobody's business but his doctor's and his pharmacist '6. " ' - ^ 

To the state's argument that compiling a registry in Albany was no diff erent jfrom ^ 
having the name and .address , on file with pharmacists the court replied: 

V . ' 
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"A name on a prescription in the files of one of the many thousands of pharmacists 
in the state is entirely, different from one's name on a form in Albany which is'. ^ 
♦transferred to computerized records and stored for instant retrieval." 

A similar protest was mounted in Rhode Island in October of 1975 i at a hearing 

Irerd" l5y tl^e "S^tate Healttr Department to alTovr public "ci)mrnWt~eh~a propo^arl^ set up 

* 18 
a similar state registry of "high abuse potential" drugs. The Rhode Island ACLU 

testified that this would create a derogatory data bank even though the individuals 
listed in it had all been prescribecJ legal drugs by licensed physicians. ACLU State 
Director Michael Dollinger said that he knew of no legal authority that would allow 
the state to "so invade the privacy of the doctor-patient relationship." He stressed 
that if the state wanted to detect over-prescribing or over-dispensing of drugs, 
and detecting theft or forgeries, this could be done by r;emoving the patient's name 
and address from the reports, and monitorijag patterns of doctor or pharmacist 
conduct. Even if the goal was to detect persons who go from doctor to doctor to get 
prescriptions, Dollinger pointed out that such persons could easily change their 
names each time, and thereby escape detection by the registry. As in the New York 
lease, the Rhode Island ACLU presented testimony that some individuals had refused 
prescribed medication, against the advice of their physicians, because of fears of 
"bein^ included in the state's data file of 'drug addicts'." ' 

ft ' < 

Problem: Narcotics Addict Registries ^ 

'Confidentiality of data ip drug-abuse treatment programs Kas been a major area 
of controversy during the past few years, with automated files playing a growing j;;ole 
in the issue. Essentially, dr^g-abuse treatment centers represent a decision by their 
sponsor's (and government funding sources) to follojn^ medical rather than criminal 
approach to addicMon ; preserving strict confidentiality fmr patient ^cientity and 
' case detaffls is- critical to the s'uccess olf these ventures. This* was recognized by 
the 1970 and 1972 Vederal laws on drug-abuse prevention and cfontrol. After providing 
federal fundsj^for treatment, rehabilitation, and research programs, these laws 
afford protection for the identities and records of persons receiving treatment in 
federal-agency programs, or -federally licensed one.s, or drug researxih programs by 
state or private agencies, when these have been specifically designated by the 
Secretary of HEW or the Attorney General to be exempted from compulsion of 
participant^ identities in any federal^ state , or local . proceedings . 

V 

!5lost drug-abuse treatment centers are not so protected, however, and studies 

disclose constant pressures from police, licensing agencies, employers, and others 

20 

to learn the identities of__ program participants. Some of this pressure comes 

from requirements that physicians must report to the state the identity and status 

'Of every addicted person they*^are treating ^1/3 of the states have such requirements). 

'"any states also have naircotics-addict registries, based on reports of identified 

patients from physicians and treatment center^ throughout the state. Some of thes.e 

stat?s, like New Jersey, have computerized their registers. V/here federal or state 

agencies provide funding for treatment centers, they often insist on having 

identified patient reports sent to them for auditing and evaluation purposes, an^ 

these are frequently put into state central databanks. As a leading> sirticle on this 

21 

issue by Pi/IcNamara and Starr in the Columbia Law Review noted in 1973 # 
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^hese centralized state and federal data banks of narcotics- 
treatment information are a great threat to confidentiality.' Of the 
(172) treatment centers respondin?^ to our survey, problems in 
protecting client records were cited 50 per cent more frequently by 
centers located in 'states with centralized addiction registries' than 
by those located in other states. The information sought from the 
centers included drug,, criminal and medical history, social and 
demographic data, prior drug treatment information, and employment 
data. * 

'^he ycNamara and Starr study noted that protecting the physical security of 
treatment center files was a problem for the managers; given available "sophisticated 
procedures, the authors felt computer,ized records could be kept more securely than 
the usual manual records. But they also saw the compactness and ease of search of. 
the file makin°: computerize^ files particularly tempting to overzealous law 
enforcement a^^ents and other intruders. 

r The study also noted that undercover police agents have been sent into some 
treatment centers posing as clients or applying for jobs, as a means of getting 
confidential information on participants. These situations suggest that protecting 
files, whether manual or computerized, would take special alertness to efforts at 
penetration from inside as well a^ outside. 

Conflicts over the confidentiality of drug-abuse treatmen't records are still a 
major confidentiality issue today. In Cleveland, Ohio, the local ACLU in 197^' 
criticized otjerations of the county's central computerized registry for patients 
receivine^ methadone treatment. The ^registry ' s purpose was to prevent individuals 
from enrolling in more than one program. But the data collected (following federal 
regulations for methadone programs )' included many sensitive items--age , sex, 
educational level, employment history, criminal history, past history of di^ug abuse 
of all types f and prior treatment for drug abuse. The 4;levelsuid ACLU objecxea to 
what it felt were overbroad disclosure provisions. for such d^itar and the conditioning 
of a government benefit on -the individual's willingness tcD surrender his/her 
privacy. They also insisted that patients should have a right "to access and correct 
the file," which was not provided. -'^ 

Similar protests, including lawsuits challenging ^ch ^ri^ji^^buse registries or 
fundin^-aeency reporting duties, have arisen recently in San F?!^cisco, Maryland, 
and New York, among others. Two states in 1973— r/'assachusetts' and 'llnnsylvania— 
refused to accept federal drug treatment funds as long as patient ^Mfcation 
required by a "Client Oriented Data Acquisition Process" (CCDAP) .had j^be submitted 
to a computerized file maintained by the White House Special Actipn ^ffice for,,Drug 
Abuso Prevention. ^-^ * ' 

The .Massachusetts ac;tion is worth examining more closely. Afte^the Governor 
informed the White House Office for Drug Abuse Programs' that it would"do without 
federal funds rather than submi^ patient identifying data, the federal officials 
exempted the state from that Requirement. "If Massachusetts will take the / 
responsibility for providing aggregate data," the director of the'office said, "that 
will be all right with us." Massachusetts therefore kept personal identification 
data at 'individual drug treatment clinics or the state's Mental Health Department. 
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Massachusetts, then found itself faced by^ another federal drug reporting demand. 
Project DAvVK (Drug Abuse Warning Network), a project of the Drug Enforcement ^ 
Administration of the U.S. Justice Department, calls on hospitals and crisis-centers 
to report drug overdose .incidents, in 1973 i at the request of the White House 
Office on Drug Abuse, the DAWN project added to its reporting forms the following * 
information: subject's birthdate, race, sex, the first two letters of the subject's 
mother's given name and heir surname. Again, the Governor of ^'assachusetts ref^used 
to submit identifying data, saying that institutions in his state would not 
cooperate in the DAWN project if these were required. The "Governor 's spokesman 
called the identification requijf'ements "a bad, ill-advised program,*' 

IVassachusett 's protest led Senator Sam Krvin Jr, and the Senate Subcommittee 
on Constitutional Rights to call the federal drug program off icials^ be*f tore it 4.n 
1973 f raise the citizens rights issues, and cafl on the s^dministration to reconsider. 
Senator Ervin reported to Congress that "once the agencies reconsidered, they 
decided that they could eret along without the objectionable information after all. 
Their data-eatherin^ continues, but a small blow has been struck for better, less 
obtrusive government." 



Comment 



Computerized central registrie^^'^bi'gas^zed around a singly t.heme — child abuse. 



abortion, drug abuse, etc* — present in another form all of the problems we have ^ 
previously catalogued. This is because a central registry is by its ,nature a 
governmental catch-all, -Some agencies with access to the registry — or ready to 
seek access — ^will ^ee it as invaluable for researchi others for providing ^ 
rehabilitation and social services; others for eligibility decisions or: to <£ivoid 

111 o^tjiers.f or *law enforcement purposes, 'The 
ted because Jhere is general agreement that society 

? * 

has a difficult problem that it must solve and that the first 'step toward a 

K * * 

solution must be identification of those either suffering from, or participating in, 
the problem behavior. These^ generally accepted perceptions lead to the creation 
of a central registry,*' and Since computerization facilitates collection of such data, 
the move to cenjtel registries has been heavily accelerated by computerization in 



duplication of benefits j and stil 
registries, typically, are .create 



the past few years, 

« Although there is often* public agreement that a central registr^^ is a good 
idea, there is ij^^ss agreement as to which of the above- lis te<5|j purposes it should 
serve, gene r^al]^be cause social viewpoints .differ as to the larger question of/ how 
the^problem ^l\^uld be solved. As a result, such registries tend to collect all the 
data they can ^n a particular subject in order to serve each of the various^ 
government agencies, should the occasion airise. 

The ill-defined -goals tend to be reflected in ill-defined limits as, to the 
identification of individuals-, what data is to be collected, who contributes -to the 
collection, and rules for dissemination, A distinctive feature of some registries 
is that unidentified persons may contribute unsubstantiated incidents of wha*t they^ 
regard as questionable bfehavior. This is true of most child abuse registries and ^' 
of some dru^!: abuse registries, ' ' " 



2k 

Incident: The Texas Central Data Bank 

In 197^ Texas announced that it was establishing a computer file at \he state 

level that would pull together and record all the state "client" services aji 

individual is receiving. ,p«Each record would have name, Social Security number, race, 

and date of birth ^mons: its personal data, and then contain a summary of state 

services being provided — ^health, mental, health, rehabilitgition , blindness,^ 

alcoholism, probation, welfare, employment, college and university, retairdation, 

youth, services, and others. Governor Dolph Briscoe explained that the state 

services index was needed to eliminate duplicate applications, coordinate provision 

of services, and improve overall state planning and organization of social programs. 

The ACLU of Texas and other citizens groups criticized the jprogram on the ground 

thaj existinfiC federal and state law^ or regulations expressly provide for the 

confidentiality of some of these services, and th^ opening the index to state 

officials — even just the listing that someone was receiving a "service" — could be 

highly intrusive. John Duncan, executive director of the Texas ACLU, warned that 

"the plan creates the potential that with the press of a'button, a nosy dean can 

find out if a student has received psychiatric services from the Depairtment of, IVental 

* 

Health, or a prying bureaucrat in the Employment Commission can find out if ^ person ' 
was a juvenile offender yeairs ago," 

The Texas" ACLU also criticized the ^'consent" feature of the state plan. Wheh 
state' off icials noted that a service-recipient's consent would be required before 
his/her^ jname would be entered in the index, the ACLU replied that agreement would 
rarely be ,un coerced under these circumstances. "What individual who "has received 
services from a mental health clinic, been confined in Texas Youth Council 
facilities, been treated for alcoholism, or received food stamps would freely 
consent* to having this information float from agency to agency via computer?" 
Jn early 1975 i Texas abandoned this plan because of lack of funds. 

Incident t Wisconsin Central Da^a Bank 

Similar mulTi-file databanks at ihe county and city level have also drawn fire 
on citizen rights grounds. In Wise^emsin the state Departments of Health and IViental 
Hyeiene proposed in 197^^ that coumies using state-services should pXace in one 
computer file information on each individual in the county using a state-financed 
service for mental health, _ alcoholism, drug abuse, or mental handicap,^ Instead of 
four separate record systems, as previously maintained by the county agencies 
involved in furnishing the^e^ services^^ there would be one set of forms for ^11 the 
services — admissions, evaluations, scheduling, etc, — and one information system 
for storing and using the data. Client numbering would be changed %o that only one 
client number would be used regardless ,of the service provided. The client number 
and case data on clients would then be sent to the state's computerized file for ' 
program evaluation, ai/aiting, etc, ^ 

When this proposal was-^esented in Milwaukee by the administrktor of the. 
County Unified Services Boaird, it drew strong opposition from mental health agencies, 
social services groups, and the Wisconsin ACLU, When the plan was first announced 
in r^ky of 197^» the ACLU consulted with st^te and county officials and concluded 
that no overriding need for t^e data had been demonstrated that would justify the 
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treats to^ privacy and confidentiality, and it called for a halt to implementation 
"^of the databank. The ACIU set out a list of safeguards that it felt should be 
'provided before such a system should ^o forward j " 

1. The ri^ht to inspect any information about herself /himself in the 
— record system. . 

2. The rl^ht to contest the accuracy 'of the information, to correct 
errors, and to have such corrections recorded in the file and* 
reported to all- those who have received the wrong data, 

3. The rifrht to place^ explanatory informiltion in his/her fi;Xe, 

4. The rie:ht to know the admiriistrative policies and* procedures 
governing the -inaintenance and use of her/his file, I 

5. The ri^ht to know the remedi'es available to her/him when' he/she 
wishes tc^challenge informal^ on Individuals should learn \his 
information Trom the agency at ^the earliest opportunity af teK the 
decision has been made th^t a file will be kept on the person's 
case. 

5. The rif:ht to be heard in person on any substantial issue concerning 
the record and 'the right to a statement of reasons if a decision 
unfavorable on the claim of the individual is made, , 

7. The citizen must be notified upon each release of information to 
an outside afrency or party and upon any inter-agenoy transfer of 
records. 

In August of 19?4» the administrator of Unified Services presented a revised, 
proposal for a county index. A computer program would transform a client's name and 
birthdate into a number and would, store records under that number, but would not have 
the name connected with the data. Each agency under contract to the Board would have, 
a terminal in its offices so that i^t could put the client'^ name and birthdate in and 
^et a number back for record purposes," Only the individual agency would know both 
^the name and the number, and reports on clients sent to the state's computer system 
would be identified only by number. To catch duplications--perhaps the prime purpose 
^of the unified data system — coordinators at the county computer operation would check 
when names wer^ submitted numbers to see whether other agencies had reported 
havinf^ that individual with them, and would check to see whether this represented 
"unnecessary duplication of services,'* • 

This revised system was still opposed by the groups that had criticized the 
earlier, plan, including the Cental Health Planning Council, Alcoho^lics Anonymous, and 
the //isconsin ACLU. The terminal feature, they said, would mean that employees and 
anyone else who^ could raia physical access to agency offices could play with the 
numbers-and-nar.e system, and that there 'still had been no"plroof shown that a single 
numberinfi: system on clients was necessary- to plaji services and avoid duplication, 

/ 

Comment 

The Central Databank concept translates into reality* the previdUsly expressed 
fears of. critics abou"*" controlled dissemination of identified information- from one 
government agency to" another. The recounting of the events |ttrrounding the creation 
of these two data banks^, and the debate over the adequacy of notice, consent, 
challenge, and correction in such systems highlights the citizen rights* problems 
these types of systems-present , One point about such central data banks deserves 
special emphasis. It is a point that we have noted in passing when describing 
smaller computerised systems, but that has a special Relevance for a large. 
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complicated multi-level data bank. The process that takes place here is that first 
the databank is created? then protests arise from civil liberties groups and 
professional ass.ociations ; then the gpyemment agency often tries to make some 
accoTPmodation to ffche complaints,^ usually with limited success. The accommodation is 
bound to be of limited success ^because the*- reforms ar^e tacked on ae an afterthought, 
and are not really viewed by' off icials as an integral part of the system. Until and 
unless such citizen ^i£:hts considerations are included in the earliest planning for 
data banks, seeking the widest acceptance from all segments of th.e community, 
recognition given later will be regarded by critics — rightly— as something 
prudringly granted, and distrust will greet even well-meaning efforts by government 
officials— as an afterthought — to safeguard these systems properly. 

In discussing the problems connected with various computerized systems, we have 
focused primarily, on the la,ck of protections for confidentiality? less attention has 
been driven to the questions of an individual's right of access. In only half a 
dozen of the episodes recounted here was the question of access raised at all by 
concerned e:roups; in only two of them was it given equal weight or more weight th?Ln 
protests about confidentiality. This conforms to the patterns already established 
with manual^ health recop4s, where fewer protests have traditionally been made over 
lack of access than ov6r*^reaches of confidentiality. However, in the past few years, 
there has been a growing consciousness that individuals do have a right o^ notice 
and access when records are collected and used to make governmental or consumer 
.qudffments about them. 

Put in the cases of comput^ized health records we have been discussing, most 
of the individuals whose records are included are- probably not aware of their 
existence. A right of access — even if it were to be established — would be 
meaningless unless accompanied by the right of notice, and this raises several 
troublesome questions i ' <, 

t . Most individuals receiving care in hospitals and clinics know that sumirar;- 
infornation about them~length of stay ,\ diagnosis , identifying material, etc.— is being 
recorded about them by primary care providers. But patients usually have no idea it is 
being computerized and sent outside the facility for various "special uses." Several 
of our episodes, such as the fetal register and the abortion register fall into this 
category. 

2. Most individuals seeing privatte physicians know that detailed sensitive infor- 
mation confided to their doctors mgLy be recoi»ded by ,them'^l But they have no idea that 
some of this sensitive information is also being cpmputerized and , forwarded to state 
health agencies. The New York State Department of Hygiene and Missouri data reports 
fall into this category. 

3. Therefjire situations in which individuals have no idea that information or ^ 
judgments (whether medical or pseuSo-medical) is being recorded about them at all, and 
no idea", therefore, that such judgments are^being centrally computerized. The Maryland 
DSH system and those child , abuse registries without notice provisions are examples of 
this, * " ' 

4. There are individuals who have an affirmative jeason to bei^ieve that 
infopfflation about them is not being trecorded ^d transmitted elsewl^ere, as is the 
case with juvenile offenders who fall u^er the protection of the Youthful Offender 
Act and its state counterparts, but such persons are mistaken in their belief. 

/ 
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K ^^^^ a concept of adequate notice to be effective » it would not only have to 

inform the individual that personal information was being forwarded to a named 
centralized data syst^em, but would also have to indicate what other agencies have 
accfess'to it, so that the individual might know where his/her records" are which 
mirht require correction or updating*. 

We noted, when discussinp manual records, that the greater the dissemination of' 
medical re<5ords into areas where they played an evaluative role— in empSdOyment, • 
licenslne^, law enfoircement etc.— the more important was the question of apcess, with 
the opportunity to correct errors. Centralized computerization heightens tTiis 
importance i^^dftect in:q^portion to its greater capacity to disseminate personal ^ 
information t;<>^^ broad" )^kriety of a^rencies and^ institutions which make such 
evaluative^ deci{|^ohs. ' ^ 

Two syecial'r'i)t*oblems of computerization th^t do not fit into the categories 
already outlined deserve mention here: 

; 0 

incident; -The Calif ortiia and'richif-an Benefjciary KxDlanation Programs^ ^, 

Improper or fraudulent claims by doctors have been a concern of the federal 
Vedicare and r.-^dicaic^' program's since their inception, as well as of state 
supplementary payment program^ such as California's ^:ediCal. To improve the 
efficiency ^nd monitor|n.- of claims processing, the Federal government pays any state 
that installs an appro\^ed computerized claims processing and , information system 90/0 
of the cost of installinf^ the system and 75^ of its operating cost^.' One of the 
conditions the st^te must meat is a "beneficiary explanation Jjrogram" in which a' 
notice is sent to the home of recipients listing the medical service reported to 
have been performed and requesting recipients to notify the state if any of these 
services were not, ih fact, delivered. » ^ 

The beneficiary explanation progr&m has been used extei4ively by states such 
as Vichiran and California as part of their computerized claims processing systems. 
, In a four month period in r«'ichifean, for example, the state seV±benef iciaries" 
1,7 million such forms. 

In 197^, two 15 year old girls had medical abWtions paid for by MediCal. 
Joined by several organizations, the *-^wo girls sued in federal district court to 
enjoin California from, mailing notices to their homes. They charged that the 
notices for all^'lv^ediCal recipients in a given household were sent in a single 
^ envelope, and that the, abortion information would thus" be available to their parents, \ 
even though California law protects the right of minors to abortion (and other 
medical treatment) without parental notice or consent. The lawsifit, filed as a 
class action, also conten,ds that the beneficiary notification program would 
"discouras:e poor people from obtaining necessary medical services such as venereal 
disease treatment^, contraceptives, pregnancy or abortion services, drug and 
alcoholic treatment, or psychiatric counseling." * , ^ 

The lawsuit also charges that. the-results , that had been achieved thus- far under 
^he recipient notificati^ program did not justify its invasive aspects. Out "of the 
1.7 million notices sent oht in Michigan, only 2,100 produced communications from 
recipients raising questions .about the^ services listed for them. Paul Allen, director 
of the Medicaid administration for Michigan declared that the program has no^ "p^-oved""^ 
cost effective." 



Comment • i . 

This seems tobe a minor organizational problem, requiring more sensitive 
procedures (such^s first-class mail for the notices) and more sensible methods 

(such as usinff raW(5m sampling in selecting records rather than wholesale mailing^). 
Tt is noteworthy because it is yet another instance of how consciousness of citizen 
rights issues in the planning stages could have avoided controversy. 

Incident; The lYaryland Drug Abuse Administration ^ 

Tn Varch of 197^» the Baltimore 'press reported that several employees of the 
Maryland (State) Drug Abuse Administration! DAA) had been arrested by ci^ryvand- state 
police and charged with drug violations involving use of narcotics "at or near the 
druF abuse headquarters." The news stories disclosed that an;, informant had notified 

, the director of the DAA several months previously that some employees of the agency 
had been usins narcotics at "a party." The Direc/tor^ I. Robert Evans, consulted with 
Dr. Neil Golomon, head of ;the State Health Department, who informed Governor Mandel 

, of the situation. The decision was made to^send an undercover state police afrent 
into the Drug Abuse agency, posing as an employee working in the planning section i 
He worked there for approximately six .weeks, ajid information he developed led to the 
arrests. 

i 

These disclosures led to a series ^ meetings in IVarch and April by 
representatives from local and statewide drug and alcohol treatment programs, 
^ medical groups, hospitals, and the r/:aryland ACLU, based on threats' to the 

confidentiality of client information posed by such undercover activity. A IV!aryland 
Committee on Client Confidentiality was formed, and a statement issued that called on 
the Governor to see that no undercover agents 'would thereafter "be introduced into 
any phase of the Maryland drue treatment and rehabilitation system*" The Statement 
explained that these organizations "do not condone nor do they wish to, defend the 
> alleged illegal use of drugs by the individuals arrested." ^ However, placemVht of a 
police undercover agent in the state drug abuse treatment agency disrupts the 
"trusting relationships" between client and cgunselor, and among a^exiciesi *^ 
ieopardized the security of the drug-abuse registry and other confidential recortis 
kept at DAA J and "demonstrated judgment incompatible with continyed tru.st of the ^ 
Drug Abuse Administration by local programs." ^ ^ - " 

Tn meeti<nfl:s with the concerned groups, DAA Director Evans stated that using an 
undercover police agent was" "the best investigative method'^ possible and "the only 
jj/ay to root it out." .He said that the agent had b^n given "specific instructions" ' 
not to.have ar^/thing ty> do with client records and other confidential data. In fact, 
he a'dded'^ the staff ifjembers arrested, becausfe of their drug use, .were unreliable 
jpersons to continue to have access to the confidential information. , - 

These explanation? were not considered adequate by the protest ingvgroups- and 
the controversy deepened. Dr. William C. Sbeling, fjead of the state university / - ' 
medical faculty and its medical society, sent Governor ^^andel a communication' 
charging that employees of DAA had made certain records from the confidential Narcotic 
Addict Registry available to. the age;if. (The registry lists all ^^oersons being 
treatfed in 60 centers throughout the State.) Dr* Ebeling's complaint, plus those of 
13 private drGg trea^fnent programs, led the state heaUh department to order an ' 
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investigation of the incident in early )toril^. 

As a result of the investigation, authoritY over record-keeping by DAA y/as 
^hifted from the agency^s director to its\nedical director, Dr, Samuel L, Fox, Dr., 
Pox announced in August of 197^ that Ihe was destroying , all records accumulated by 
DAA over the past five years* that identified drug users by name, leaving the 
originals of those records ofily in the local programs. He also» mpd*if ied proposed DAA 
regulations which would have required names to be sent \o the stat^ 'and set up 
a coding system instead. * The Maryland Association of 1«ental ^Health and other groups 
hailed the new policy,* aad J.ohn Roemer, director of the state ACLU, praised the 
decision as "a large st^ forward in protecting both' privacy and rehabilitation," 

However, the question of whether police would be used in the future as .undercover 
agents in'd^ug programs and other sensitive social-rehabilitation programs was not 
addressed by the Govjfnor, or any state health officials, John Roemer^ no^W t^t 
the 197^ ^incident ought to be a warning that no state registry or record-system cmTfH^ 
be considered secure and its data confidential if the "needs of law enforcement** 
prompted its keepers to allow 'isuch undercover^ penetration by the police, "There is 
no guarantee that such an agent would no^ look at the records if that would help in 
^ the^ investigation, and it would Ue almost beyond human nature for such an agent to 
resist a peek at the files for a wide ran£:e of ^police investigation, " 

Comment ^ ^ • 

We have tried to avoid as far as possible the "what if?" approach to * 
computerization, and to confine our analysis to factual episodes. However, the 
-placemient of an undercover agent in the proximity of supposedly confidential files 
- speaks to all the fears generated by the ^ixon-White House plumbers, the burglary 
of Dr, Fielding's office, and the complex o-f issues raised by Watergate, It cannot 
help but evoke the question: What if the lie^d'were compelUng enough—say a threat 
to the President's, life, or the danger of a mass terrorist bombing? Would any 
sfcrstem, even one like'MSIS, protected by special statute, be secure against 
encroachment by law enforcement officers? And if^such "appealing" situations were 
held to justify law enforcement' access, then who among state or federal health' 
officials would have the power— and the incentives and guts— to inquire into the 
declaration of such "special needs" by law enforcement officials? *=» 

The answer to this and other "what-if *' questions lies the adoption of^ 
specific protective statutes, and of special review bodies to pass on requests for 
exemptions or exceptions. But it also requires a deepening of societal attitudes, 
through 'court decisions, greater public familiarity with the danger^ as well as them 
benefits of computeri2a1j;ion, and greater sensitizing of public officials directing — - 
•government health and social services, Xhe ways, of fostering such attitudes will be, 
discussed in the concluding section of this report,- 
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Incident t The Medical Information Bureau ^ . ' * 

So far, we have ct^nf ined" our reports to incidents of g9vemi)a^nt computerization, 
which i^ where most publie^attention has been focused. But the problems of 
computerization ^re raised is well by some private organizations. As an example, we 
will^ return to the Medical Information Bureau, whose operations have been described 
earlier in Part I. 

Tbe MIB system was a manual, card-index operation for the first sixty-odd years 
of its existence J in the late 60's it was processing 10-15 million information 
requests annually from its 700 member life insurance firms. * In I970, MIB automated 
its files. It presently uses^a service bureau in Boston to store data on some 
11 iTillion- persons who have previously applied for life insuirance , and to handle 
requests for reports. » 

There-was no ch^ge, as a result of automation, in the kind or extensiveness of 
the data that MIB col^ec4ed, stored, and distributed to its member companies- But 
the fact that MIB was not known .to the public, and especially to individuals who 
might be denied life insurance or rated more highly by a life insurance company " 
because of information suppUed by MIB, prompted widespread criticism in the late 
i960 's and early l970's fronNgj^t'sumer advocates , civil liberties groups, and 
Congressional spokespersons. The fundamental criticisms wef^over the kind of 
"social data** that MIB had been collecting and disseminating (Sexual behavior, 
finances, life style, mental -impairments," etc.)i the lack of any provision for a 
person to inspect, challenge, and correct the information in hisAer record, and 
the capacity of member life insurance' firms who also write accident, health and 
auto policies to obtain 'use of MIB data for those purposes even though MIB rules 
said they should not ^ this. The fajCt that the Fair Credit Reporting Act of I970 . 
contained an exemptioh for medical data meant that MIB was not covered by the 
n(3^fication and accesS' protections of that law, and this generated extensive 
criticism in hearings before Senator Hart in 1972 and Senator Proximire in-1973-, ^ 
and^n both tHe medical and general press. 

* ^ MIB reacted both slqwly and defensively to these complaints. _In ^November, 197^, 
it did stop collecting informktion about "sexual deviation" and^social maladjustment" 
In an interview in the Baltimore Sun on July 13, 1975, Joseph C. Wilberding, MIB " 
Executive Director,' stated that the Bureau Had voluntarily eliminated l^hese 
categories fr<?m its •'inipairment " category. Instead, it substituted new 
categories that would alert an inquiring company of the "existence- of such 
Njjjormafion. "All that is reported .now, " Mr. Wilberding explained, "is that jcompany 
XXhinks they got significant information from an unidentified investigative report. 
They are not reporting information, but they are -reporting the possible existgnce of' 
^^formation that must be further checked out> This left many critics unijppressed. 
In August, X97k MIB ani^ounced that insurance applicants would henceforth be 
told ^n writing by MIB member firms that health data they supplied wouid ^e 
submitted to MIB for storage in its computer system and might later be shared with 
life insurar^e firms using ther -system.* . ^. . . . 

* Footnote on.:top of next page 
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* • An example of this new procedure is the,notit;e used^by Union Fidelity Life 
Insurance Company i ' • - / 

IMPORTANT NOTICE . ^ 

Inf orn^tion regarding your insurability will be treatexi as 
« confidential. Union Fidelity Life Insurance Company may^ however, 

briefly report tc the Medical Information Bureau on information / 
received with your application. The Bureau*, on request from 
a member company to whqm you may apply for insurance, or from- 
^ . whom you^may claim benefits, will supply such information to 

^ the company. If you ask, the Bureau* will arrange to disclose ^ ^- 
the information in your file (medical information will be 
disclosed only to. your attending physician), ^and you may seek * , 
to correct any inaccuracy in accordance witja the iJ'air Credit 
Reporting Act pr^edures. 

.Union Fidelity Life Insurance Compginy may also" re leaser information 
in its file to other life insurance companies to whom you may 
apply for life or health -insurance or to whom you submit a claim 

* for benefits. Union Fidelity Life Insurance Com^feny will not, 
however, reveal to another company, or to the Bureau, the action 
taken on the basis of your current request for insurance. 

*A non-prof it^Toembership organization of life insui:ance compsinies 
which operates an ^ information exchange for its members, P.O.Box 
105f Essex St^tionr, Boston, Mass. 02112, telephone 617-426-3660. 

VIB also provided that an applicant for insurance who wished to review his*/her file 
might do so by asking that the information be forwarded to the insursuice compsuiy to 
^ which the application had been made. . That company would then make it available to 
the attending physician, who could review it with the applicant. Correction of any 
erroneous data would be made in general conformity to the procedures of the Fair - • * 
Credit Reporting Act, - ^ 

These procedures were still met by criticism. It was argued that the notice * 
ought to be printed on the insurance application itself, and that access should be 
available to the individual directly not filtered through 1(he insurance company and 
through the "attending physician." . ' ^ 

In 1975 f ^TIB^ further broadened its access policies. Now, individuals could ask 
to see their MIB record directly, and^could do so upjon providing identifying .data,, 
and supplying a detailed history of previous insurance applications. Any "n'on -medical 
information "in tfie f ile Jijould be released directly to the individual, by reversed- 
charge telephone call 6r personal appointment. Medical information would be 'disclosed 
only to the individual's personal physician. To 6btain the medical inf opmation, a 
release had to be signed freeing MIB 'or its me^er companies from any liabilities . or- 
damages in connection with the information. This release applied to medical 
information released' to the individual, and was based on the fact that MIB had, no 
obligation under the Fair Credit Reporting' Act to disclose its record to the 
individual. • ^ ^ • 

To the criticism that. medical records may be disseminated to unauthorized 
individuals or misused, MIB points to its rules that prohibit tHe .tran.smjLssion of 
medical infdVmation to life insurance companies unless accompanied by a signed 
authorization, and which prohibit life insurance companies from rejecting .an . ^ 
-applican-t- solely on the basis^of.a negative MIB report.' In the in;terview cited ajove, 
however, Mr. Wi^berding conceded that the Bureau has only two employees tp review the 
19' million requests for MIB reports each ye\r, and that in a period of ^rnore than two 
years it Was able to review the general procedures for comE^iance of less than 30% of 
* # ** . * 
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itS- 716 member companies, - T 

Comment / , . • 

MIB first attracted attention in the. m3fd-1960«s, when legislative committees 
and writers on privacy began to publicize the presence of this central registry of 
medical and^ non-medical information for life insurance companies. Yet it was not 

• until 197^ that P^IB modified its use of "non-medical". data, and not until 1974 tiTat- 
itt adopted policies for notice and access that meet what almost all observers would 
regard as fair procedures to protect the interests of , life ^insurance applicants. 
That iV^IB is^QOW taking some corrective steps is praiseworthy; but that it took 
agitation^ by critics for almost a decad^ to. produce organisational responsibility 
does^ not speak well for MIB, for the life insurance industry, for the public 
officials in the state legislatures >vhere MIB is chartered^ ( Connecticut ) or has its 

^ files^ (Massachusetts)*, or f^r Congress, which ought to have written careful 

provisions to protect consumer^rights affected by the MIB data bank whan it enacted 
the Fair Credit Reporting Act in 1970, ' , - 

Incidentt The Georgia "Free Consent". Experiment^^ 

>^hen government agencies computerize health and welfare client irecords, and 
when professional groups or civil liberties organizations raise questions about the 
confidentiality or security of the. client data th^t will be stored, two typical 
responses are made, by the systems majciagersi Jl) only authorized personnel and 
^ legitimate users will hav« access to the data, and (2) the clients- themselves are not 
\ worried about violations of the privacy of their records; this is mainly a case 
of overblown fears by seli'-apj>ointed defenders; When it is ^pointed out that clients 
asked to give their consent to have health and welfare dati sent to state computer 
^ systems d)o not really have a free choice— since they might jeopaijdize their benefits 
if they reTused consent— the answer is that no one really -objects , 

An important experiment testing this assumption was performed at a Community 
Mental Health Center in Georgia during 1974-75. Before July of 197^, reports of 
services rendered by the community centers. were sent to the State DivisioYi of Men^>^l 
Health identified, only by case numbers. For. -that reason, no need was felt to infort 
- clients that information on them was being sent from the local center to "the etatS^ 
computers , " 

On July 1, 1974, Georgia directed mental health clfnics and centers to send in 
for each new clienti his/her name,Soqial Security number, primary disability, jpr^vious 
mental health services, diagnosis, and other personal background data. Dr, Catherine 
E. Rosen, director of research-^'and evaluation at the Northeast Georgia Community 
Yental Health Center (in Athens, Georgia) saw this as an opportunity to test how 
clients really fel^ about releasing their personal data. She designed an experiment 
that would^see whaA clients wojild *do if they felt t)iey had a. real choice ih this 
m§^t'ter,. - ' 

The center's lawyer prepared a Medical Release Authorization Form" that read as 
follows t , • , _ 
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TThe undersigned patient hereby authorizes the Northeast 
Georgia Community [Vental Health Center to furnish the / " 

Division of Mental Health of the Georgia Department of 
Human Resources. a record or records * including the 
following information: patient^s name, social security 
number, and nature of patient's primairy disability,^ 
Nothing herein shall authorize the Northeast Georgia 
Community Mental Health Cei^ter'or the ,.Geor:gi'a^ Depairtment"' 
of Human Resources to release said records to tHe general 
public, as is 'prohibited by Section 40-2703, Code of 

Georgia," ^ . ' ' 

During Phase I of the experiment, from July of 197^ to Mairch of 1975. each of the 
962 clients in th^ Center's four clinics were presented with the f^orm and signed it, 
(Illiterate clier\ts had it read to them, and clients "too distraught to deal with the 
form on intake had it presented later). Compliance Was ICTO^, ^o one declined to 
sign, ^ 

During Phase TI , from March to September of 1975 » "the Medical Release N 
Authorization Form was still given to clients tp read. But then different additional 
p roc edure^wer&^ employed. In two clinics, a '*no option" statement was read aloud to 
the client, This saidi ^ J 

"The State wants to keep %, refcord of name, social security number, rand the type 
of problem of every person who comes for mental health services. The reason why the 
state wants this information is so that it can keep^-trapk of mental health services 
and clients throughout the state. If you sign this paper it means you give us 
permission to s^nd in your name, social security number, and diagnosis into the state 
offices in the capitol, where^it .will be placed in the Mental Health computer file,** 

In the Center's other two clinics, this statement was also read but it was 
followed* by an additional statement suggesting that t^e client has a genuine option. 
This stated J 

, "If ^you do not sign this paper, this identi'fying irrf ormajion will not be sent ^^ 
into the state offices in the capitol and will -be kept only locally. In other words, 
if you dqn't sign you will get the same services from us as %X you did sign," 

. 4^ In all th4 clinics, a pen was placed on the table after the reading of the^ 
statement so that the client could maJce his/her decision. 

- In th^ two^^clinics .where 109 clients heard only the "no option" sfatement, 
complianpe was JOO^i everyone signeS, But in one of the two clinics where both ' ^ 
statement^ were read, compliance among 259 cliepts dropped to 41%. In the other, 
compliance .ajjipng 104 cliei>ts dipped to 2.0%,* Analysis of the non-compliers showed 
them to be more often ifemales and better educated, but there* were not significant 
differences Irr 'Ot he r^ variables, such as age, race, income, apparent nervousness, ^ 
'sevei;ity of problem, etc, , . ♦ ^* ^ 



*In the clinic scoring 41%^compliance , a clerk j)resented the opti^ont th«»*cJ.inic 

^ having 20% compliance ^ad the clinician present it, Dr, Rosen 'believes that the* 

'willingness to withhold consent rose when the person who would provide the client 

with th^ mental health service he/she wanted said, that there would be no lessening 
of service, • ^ 

2i<4'^^ 
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The spontaneous remarks made by clients when presented wi'th the "option** 

statement left no doubt what was in their minds in refusing to sign. Concern 

was expressed about the effect of forwairding the. information Ton the clients • current 

or future employment, possible loss of custody of their children, and feairs about 

the information being used against them later for some government purpose. 
* * * 

Comment ' 

Dr, Rosen's study provides striking proof of what civil libertarians have been^ 
asserting f'or j^ears — that the millions of persons who are clients of government 
he^th services do care about the circulation of their personal data, and that their 
consent would not be freely obtained for many inadequately protected government data 
systems if clients really had adequate notice of what was to be done and felt they 
had a real choice of whether to consent or not. After Dr, Rosen *'s study, it Ought 
to be sugfi;ested to every proponent of a sensitive >data system, especially the 
computerized ones, that they administer the type of •'real option" statement that 
Dr, Rosen used to a sample of those persons whose records would go into the system. 
Only when a substantial majority gave such consent should the proponents be allowed 
to assert that "pe3^e don't object to having their data in^'^tjr fine system," 

. • - • . ■ ; ■ ' \ 

OVERALL COI^CLUSIONS ABOU? "COf/:PUTER IMPACT" • ^ 

' \ 

All the incidents we have pre^sented in this chapter arose from Zone 2 or Zone 3 
activities — uses t>f computerized medical records or health data for utili£ation 
reviews or to" jna^^^^aluative "non-medical" judgments about Individuals, But the . 
sources of the data irrmany such cases were computer files maintained by primary 
care providers in Zone 1, and thus /collection and storage there has to be^ viewed in 
light of the demands for production of iUentiJfied data being made by the Zone 2 and 
3 activities, 

^Our analysis of these incidents 'suggests -some ^almost painfully simple 
conclusions. Most computerized health data systems ar^ being created or expanded 
without sufficient consultation in advance with. groups re-presenting citizens rights 
and doctor-patient interests, and"*without some kind of proceeding open to the 
general public. Most data systems lack sufficiently developed analyses of how much 
and. yhat kind, of identified personal data they realty nee'd to perform their function 
Even when properly^ defined, md^t data systems fail t^ adopt sufficiently precise 
standards of co^ifid^ntiality , controlling uses with^ the organization and releases' 
of identified data to third parties, WJfen it cdmes 1>o rules for permitting patient 
access' to their own records, very few computerized org^izajt^ions have adopted 
procedures responsive to those patients who ask for and' insist upon^cces^. 

Noting these general defects is not to say that there are no real problems of 
conflict infff values or hard choices of social priority involVed, Indeed there are, 
and that is what we will take up in our final chapter. But we approach this task 
of discussing alternative policies and making recommendations with trie judgment that 
bo*th citizen rights and effective use of computer resources require that we move 
away from ambiguous and ill-defined systems that leave people uncertain and fearful 
about their capacity to control the circulation of their medical and hegilth data. 
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CHAPTER 12. COMPARISONS -WITH OTHER DEMOCRATIC mTIONS ^ 

Before considering policy alternatives, it is helpful to compare American 
developments with regard to medical automation and citizen rights with tretids in 
other democi^atjic nations. While we did not study the situation in otfier countries 
with the intensity that we 'did for the United States, -we did 'deVelop a combination of 
published sources, personal interviews, correspondence with government health agencies 
and medical societies, and visits to selected countries on which* to base some useful 
comparative observations. * 

Health care patterns* reflect national cultures. Among advanced> industrial 
nations with parliamentary institutions, chis leads to diversity, for example, in how 
much of the gross national product is put into health care, how the health delivery » 
system is organized and financed, the scope of- services made available to the 
citizenry if there is a national health insuraince plan, the roles played by ctrntral 
and local government, tlie type of administration over public and private health * 
institutions, and the degree of regionalization that is used fWf health services. 
There are also important differences in law and administrativ'ie^^.^li^dition among 
democratic nations that will affect aul^omation in health care, as'with the presence 
in countries such as Sweden and Israel of a national citizen number that facilitates 
record linkage along regional or national lines. 

Along with such national differences, there are also many common elements in 
the health systems of industrialized democracies. The percentage^f gr.oss National 
'product spent on health care has been rising steadily in these nations during the . 
past decade, along viVth public expectations that providing access to health care is ^ 
,a public responsibili^ty . A concentration on preventive medicine, outpatient care, 
and regional coordination has also been common to ma^y» national scenes. More 
generally, the concepts of medicine, the organization of practice into specialties, 
aild techniques of medical procedure are widely followed in Western societies, while 
the status and attitudes of medical professionals ag an occupational smd the 

organization" of hospitals and clinics as institutions also exhibit many simiXfir ' 
characteristics. ^ * ' ^ n 

The tradition of medical confidentiality — the doctor-pa,tient bond — is^a common 
Hippocratic heritage expressed in the ethica^ codes and legal systems of each ;tfestern 
nation. In addition, all the democracies have^ hSd concerned public debates during 
the past decade over the,JJipact of advanced technology on privacy and citizen rights, 
SO' 'that a general sensitivity to this issue has" become part of the political culture 
in each of these nations.^ * <» , ' » 

Dissemination of computer technology has-.also*been a mufti-national force. The 
major computer manufacturer^ and developers of software systems operate throughout 
the indilstrial nations, spreading machines, systems concepts, anc} tales *of successes 
and failures as part of their marketing endeavors. In addition, international 
conferences of health professionals and medical automation specialists exchange 
techniques and experiences with each successive generation. of computer systems. 
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we examined computer development abroad, we found the same pattern of leading 
edge systems r mainstream users, and low-level users as in the United States. Both 
from our observations and the commentaries of technical and medical experts, it was 
clear that no country as yet has a single computerized data system integrated 
throughout its national health care programs. Most leading-edge applications are 
within single hospitals, or in local (regional) health-service deliverjj areas, or In 
their regional or national health-payment plans. Even these applications are usually 
described by their developers as still "experimental j none have yet filtered down 
to common practice in the clinics, hospitals, health plans, or government health 
^ services of any country. 

Leading-edge applications in most European nations do begin with a gt'eater role 
for national or regional government than is true in the U.S., ei'then through a i 
socialized medical system or a national health plan. This puts most other democratic 
goverrawents in a more direct role vis-a-vis the funding and evaluation of computer 
applications in health care. In addition, government agencies are often the direc;* 
managers of regional health data systems that maintain a record about the health of ^ 
each resident in a city, county, or similar unit. Here the availability of official 
citizen identification pumbers has played* a major role. 

Within hospitals\ either as Single institutions or as cooperating members of a 
consortium sharing^ a common computer system, the pattern of applications being 
pursued in Europe parallels closely what we have described in American hospitals. 
A few hospitals are pursuing unified hospital information systems, and report 
themselves in much the same modular ly-develgping situations as Kaiser-Permanente , 
Vassachusetts General, or the Texas Institute for Research and Rehabilitation. Other 
^ leading hospitals are pursuing discreet applications, such as automated multiphasic 
health testing, problem-oriented patient records, cardiac display, nursing^ station 
systems, 'and the li'ke. The great majority of computers in health care in\ll these 
^ natipr^s is still devoted to accounting systems and administrative repijPting. / 

With this brief overview we will turn to a discussion of how medical automation^ 
and citizen rights activities are developing in six democratic* na^tions : Britain, 
Canada, ^est Germany, Australia, France, and Sweden'. 

Great Britain / 
\ I 

The National Health Service (NHS) provides univers^ con^r^ensive medical care 
:for all residents of Great Britain. The patient's point if enW into the system is 
Jhfe family physician, a general practitioner whose government remtinei^j ion combines 
a basic practice allowance, fees for specific items such as maternity service, and^ 
^ capitation fees. Approximate ly/( 98 percent of the population is registered with a- 
National rf^alth Service doctor. 3 a' few private 'health insurance programs have ^een 
retained and are general^^ usecT to obtain the services of consultants or benefits 
such as a private bed in a public hospital.^ 

The -1972^ NHS expenditure (1,2,832) represented 5. 06 percent of Britain's. QjNP.'^ 
Over 85 percent- is financed through general taxation. A little less than ten percent 
, of the balance comes from workers' and employers^* National. Insurance contributions, 
•with the remaining amount coming from services requiring cost-sharing, ^uch as dental 
treatment and, charges for private beds in- public hospitals.^ 
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The Department of Health and Socidl Security is responsible for the 
administration of NHS," which was extensively reorganized in 1974.. Currently the 
basic unit is the District. It supplies 250,000 persons with community health 
' services t~iupported by the specialist services of a^'district general hospital. The 
Area Health Authority is the primary leve.1 of statutory authority with planning and 
operational responsibilities. Fifteen Regional Health Authorities, under national 
po'iicy guidance, allocate, resources to the Area Authorities."^ 

NHS physicians may practice alone or in a group, and over half the family - 

doctors are members of partnerships . ®' In 1972 there were 5^,500 physicians in Great 

Britain, a ratio of one per 1,000 population.^ About half the general practitioners 

see private (non-NHS) patients, but only five percent have -more than 100 such 

patients. The number^ of hospital beds in 1971 was 508.,000, a ratio of 9.4 beds per** 

11 ' 
1,000 popiii€rtion. During the 1962-1971 period, in-patient cases increased by 19. 7 

percent, but the average time spent in hospitals by in-patients fell from 33.46 days 

to 23.87, a 29 percent reduction. New out-patients rose by 9.1 percent. The 

proportion ^f private beds in hospitals is one percent, and the number" of private 

patients treated is usually just under two percent. 

Enthusiastic predictions in the middle 1960's about the extent to which 
computers could be-utilized within the British health care system have been tempered 
with" tiiflt and the complexiT?i^s^of experience. While the British remain active in 
their search, for computer applications, the Department .of HecCLth and Social Security 
has recently instituted an evaluation program for potential applications based on a 
three-sfep process of experiment, development, and implementation.^^ Though this 
cautious approach has become th^&^orm, most observers note that the place of the 
computer in the delivery of health caire is secure. As one expert recently stated, 
**In contrast with the sitftation a decade ago, when a computer might be^ considered an 
optional extra within the Wealth Service, computers today play a vVtal role in many 
Healthy Service activities and their future potential appears virtually limitless."^ ^ 

There are three principal types of medical computing activities in Great Britain? 

(1) large batch processing installations concerned with routine finance and national 

information systems; (2) small installations usually dedicated to single applications 

and associated directly with medical science, pathology, .radiotherapy, etcj and 

(3) hospital^Dased information systems that would be considered "leading edge" 

systems. Among the .applications in the second category are a computer-based drug 

17' ifi 
information system, automatic dischairge summary systems, and a computer assisted 

system for the management of hospital waiting lists. / 

Probably the best-known leading-edge system is the London Hospital Project. The 

London Hospital is a multi-facility acute general hospital that serves a large local' 
, population in the East End of London i it is also a highly respected teaching 

institutdrOn., — The project was launched in April 1968, and by early 1972 the first 

application was ready to begin, using Univac equipment* 

The first application implemAitec} was the waiting list, followed by 

and discharge procedures. A patient index now covers 30,000 records and 

a facility for searching the ^ndex with a minimum of identifying data, aJ 

the^ admissions/discharge procedures include a survey of empty beds. "The 
t services that have beenadded, however, are thoqe concerned with requesting 
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laboratory tests-- micro-biology was the first, followed by haematology, bacteriology 
and biochemistry . 

Currently unde^. development is an extension of the Patient Index to cover all 
new outpatients. X-ray requesting and reporting, nursing manpower reporting, and a 
number of minor applications. These d^velopi^ffents require further extension of the 
communications /hardware ^hto new departments of the hospital and an increase in the 
number of visual display units, printers, and lines from the computer room throughout 
the hospital. 

In May 1970, the Government appointed a Committee on Privacy headed by the Rt. 
Hon. Kenneth Younger to consider whether legislation was necess8u:*y to provide Britons 
w^th protection from invasions of privacy arising from activities of private persons 
and organizations. (The Younger Committee was not given authority to investigate 
govei^ment invasions of privacy. That was to be ^handled through an "in-house** 
inquiry by the Government itself, under the Home Office.) 

In the area of medical privacy, the Younger Committee considered problems raised 
by epidemiological research, (such as the terms under which it is permissible for 
med-ical research workers to gain access to medical datS without the patient's explicit 
consent) and privacy issues created whep individuals were treated by physicians 
hired by their employers. On the basis of a national opinion survey, the Committee 
concluded that the British public is not extremely concerned with violations of 
me'dical privacy and that the principal dangers stem from the increased access to 
medical information by non-medical personnel — such as social workers and researchers?-' 

According to the Department of Health and Social Security, the existing status 
of confidentiality for medical records can be summarized gis follows t "The basic 
principle applied in England to all information 9btained or compiled about patients 
for the purposes of health care is that it will not be used for any purpose other than 
that for which it was supplied or obtained without the consent of the doctor or * 
dentist concerned and, usually, of the patient. This applies both to personal detaifls 
provided bythe patient himself... and to informa^tion compiled by doctors and o'thers 
relating -tTo thfe patient's health. .. .Confidentiality is safe-guarded both by the 
ethics of the medical profession and of those other professions which contribute to 
health care. 

"It is for the doctor or dentist concerned to decide initially whether information 
about his patien4^, provided or obtained in confidence, should be disclosed 
voluntairily outside the health care team; to a relative or a patient, to the patienjb 
himself, ht to an/ other person .or agency.'^ ^ Medical ethics would usually require that 
the consent of the patient should be obtained ^o such a disclosure/ but the doctor 
or dentist concerr^ed would decide whether, in a particular ^case , disclosure without 
the express copsent* of the patient was ethicaJ^ly accepta^le^ . . .A patient has no 
right of access to his own personal health records, or to any inf ormation^ont^iined 
therein. It is at the discretion of the doctor or dentist concerned to disclose to 
his patient^such clinical information as he considers necessary and advisable in the 
circumstances."^^ 
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The code of medical ethics of the British Medical Association states that the 
"responsibility of a doctor for the safe custody *of his confidential records is 
the same whether the records are conventional or kept in a computer. •'^^ A I969 
report issued by a BMA Working Party on Computers in Medicine discusses the 
complexities added to Jthe confidentiality issue by the computerization of health data 
and notes the need for appropriate procedures to protect the validity and 
confidentiality ^f the information. 



General conqern has been expressed in Great Britain regairding the growing field 

of medical record linkage. Several groups of doctors protested against the 

establishment of a central databank for the Oxford Record Linkage Study on the 

pounds that existing laws and procedures do not afford the records sufficient 

protection (e.g., the records are no^ immune to subpoena) and that these records 

could be linked with social service and criminal "records^o create general dossiers 

on persons under government inquiry. Similar objections were made to the 

establishment of the Mental Health Enquiry, a national psychiatric file. Both of 

27 

these activities proceeded with their work, however. ^ 

In the courts, questions frequently arise concerning the release of medical data, 
usua^-ly in connection with a le^al proceeding. In these cases, the courts generally 

allow the information to be given only to the concerned party's medical advisor, not 

28 

to the individual or his or her legal representative • Another recent decision 

requires doctors to give police officers information about a/p5itient which may lead 

29 

to the identification of a driver alleged to be guilty of a motoring offence. ^ 

In December 1975 i a White Paper issued by the Government proposed legislation 
to Establish a statutory Data Protection Authority with powers to ensure that ; 
computers are used with a proper regard for privacy and with safegu^ds for the 
personal information they^ contain. The White Paper states that the existence and 
purpose of informati^ Systems holding personal data in computers should be publicly 
known., as should the categories of data they handle, what they do with the data, and 
who is likely to have access to it. The information should not be used for a 
purpose other than the one for which it wa^ given or obtained without either the 
consent of the person whom it concerns, or some other authorized justification. The 
subject should be able to discover what has been done with the data and to whom' it 
wag given, ''and information should be kept only for as long as it is needed. A 
t^mporsury Data Protection Authority was appointed to work on the problem during the 
time period prior to the enactment of the national legislation.^^ 

Cgmada 

Primary responsibility for. health caire in Canada is vested in the provinces, 

' under the administration of a provincial Department of Public Health. Health care 

r services are provided through provincial health insurance programs which cover 

approximately 99 percent of the population. The federal government supj^lies' half . 

^^^tj»4 funding for these pro-ams, while the provinces finance their portionV^alf 

through general tax r^enues and half through monthly premiums paid by families 

31 

according to their income level. ^ Private^ insurance compajiies offer supplementary 
coverage for items not included in the govemjfiept plans, such as private beds and , 
the ten percent surcharge that physicians sometimiis add. 
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• Estimates of the proportion of the Canadian GNS. devoted to health services vary 
from four percent-^ to over seven percent. In 1971 there were 32,625 physicians in 
the country, a ratio of one to 661 persons. Nurses numbered ll4,303,- a 1/186 ratio 
and there were 7,664 dentists, a ratio of l/2814,"'^ Canadian pRJ^aicians are paid on 
^a -fee for service** bafeis, with reimbursement fairly automatic. 

The types of automated medical information systems and computer applications in 
medicine in Canada cover a broad spectrum. One sophisticated system is the Maritime 
Ambulatory Record System, a federally funded health research project in the Maritime 
Provinces whose priYne object iv<^is the development an^ implementation of a» quality 
care ambulatory health record system, and the introduction of the system, ,where 
appropriat'le , into private doctor^'* offices. 

At present the Project is using a CRT terminal to a^^tract information from the 
patient's record and place it in computer file, using a Control D^a Corporation 
(CDC) computer. Some outputs that aire possible with this system are individual 
health profiles, family profiles, practice profiles, immunization status cejjort and 
automatic recall, peer review, and a variety of family medicine research projects. 
Several factors^ which facilitate the implementation of sucb a computerized system in " 
this location aire^that every resident^ of the provinces is ^registered with an insurance 
number, providing a standard life-long identification; that Medical Services 
Incorporated, the third party insurer, maintains a population file listing medical 
•encounters for accounting purposes; and that the region is geographically small and 
discrete, with a population of stable and manageable proportions^i'^^ 

The Department of National' Health and Welfare is planning a computerized heaj-th 
record system for'the 35»0OO people in the Northwest Territories, which .will feive 
district health offices access to an Ottawa service bureau through telecommunication 
links. The system would contain information on individual health, doctors, facilities, 
and social prob3/ems such as alcoholism and drug addiction, 

Other ty^^of computer applications in Canadian health care delivery include 
clinical laboratory systems, which have proved to be coat-effective for high-volume * 
laboratories?^ a few patient scheduling "projects j automated electrocardiogram 
analysis J multiphasic screening? and medical auditing, At KacMaster University, 
ele-ctronic dat^ processing is used for an. epidemiological analysis of patients 
attending t he ^ family praptlce unit^ and registries have been developed for cancer, 
dialysis equipment, and patients with severe kidriey disorders, • . ' 

The* Science Council of Canada recently issued a ^-eport recommending the 
development of regr^nal .computerized heaitt-rrrTformation systems covering. all 
Canad>^ citize^is, with the information available to doctors and medical researcher^* 
throughout the country. The /report found the use of oomputer-based information 
pro/:eesing in health care systems desirable as well, as inevitable, and urged the 
^development of health J^ifopfiat ion sys"te*ns as an essential tool in solving operational 
research problems of. Canadian health care,^^ 

, The earliest legislative activity reflecting a concern for privacy pi»otection 
in Canada came at the Proyincial level. In 1968, British Columbia passed a Privacy 
.Act using broad language to prohibit violations of privacy that are willful and 
„ •'without claim of right," Manitoba passed similar legislation in^970, and other 

provinces have concentrated on specific areas 6f protection-, such as consumer credit 
. investigation and reporting. ' f . 
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At tl\e Federal level, the DepaLTtments jof CommuniOaiions and Justice commissioned 
an e^^^nsive Study on the subject of computers and privacy^eairly in 1971 • This 
report, issued in 1973 » noted the absehce of legislation assuring the privacy of 

health data, and pointed out the special problems raised in. Canada by the fact that 

✓ ♦ . ♦ ♦ * 

significant amounts of computerized data are actually physically located in the 

Ur>ited States. In the medical field, this includes information collected for 

utilizat ion *re view, such a^ -Canadian hospitals participating in the PAS data system. 

. ^ The study found a ponsideral)le exct^ange of healtj:i inf cJbmation among government 

■and private .agencies. "The response to one questionnaire indicated that 78 percent 

of responding law enforcement agencies^ 91 percent of the insurance agencies, 59 

percent of oil companies,, and 70 percent of the major industrial .employers obtain 

information about individua-ls from "medical sources" at least some of the time. 

In regard to computerized i nf or mat ibri>jiy stems in general, the report commented 

on the neei for regulation of datab^ks that contain sen^sitive information about 

identifiable individuals, with pairticular attention to accuracy, relevance, control 

over distribution, securityi standairds, the provision of opportunities for access, and 

guidelines f or^^ollection procedures, ^ xhe report^also concluded that the 

government, •*aS the principal collector and instigator of the 'collection of personal 

information, has a key role to play," and suggested that some appropriate responses ^ 

might be *the establishment of a surveillance agency and an ombudsm^i a code of 

ethics governing reseairch conducted with government funds, and the implementation of 

^ Administrative rules enforced by a central agency. 

Peter Robinson, deputy clj^irman of .the computer-communication*^ secretariat of 
the Canadian Federal Communications Department^ noted that the creation of the medical 
databank suggested by the Science Council would requir^ the use of a Single Identity 
Number to allow doctors a^d reseairchers to coordinate information from 'different 
sources. He criti^a^zed the C9uncil*s report for ignoring the issue of privacy 
invasion that would be raised by adoption of such a number 

As m the United States, -the medical record in Canada is .considered to be'* 
legally the proper-ty of the physician, and $he hospital record belongs to the 
hospital ♦ >While the question of patient access to records is a looming'* issue , 
privacy and confidentiality problems have so fgr recei;ved more attention.. 

A proposed piece of legislation in Canada, the Canadian Human Right? Act, is 
partially devoted to the protection of personal information, and if passed would 
affect fico^emment-held medical records. The Act would permit the Government to 

^-4sstl^ ref^ulations prescribing the conditions under which third parties would have 
access to identified records, when individuals would be notified that records are 
maintained about them, and under what c^ircumstances records could be corrected j 
The bill has passed only its first reading," with t^e remaining two readings not 
expected sofen.^^ ^ « . ' , 



^ Federal Republic of Germany \ . 

The Federal Republic of Germany has one of the. oldest public health insurance 
programs in Europe, dating back to 1883. . presently over 90 percent of th^ * 
population is insured through stdttutory prograrjs* Other f oras of protection, such 
as private insurance, bring the percentage of persons covered by some form of health 
insurance to 98.6 percent. ^ • \ 

The administration* of the system is decehtralrfc^, with 1,800 local health 
insurance ''furtds** serving the population. There are three general categories of 
persons covered by the statutory program. Those compulsorily insured ^onsist of all 
wage earners, salaried employees with incomes below a prescribed ceiling, and persons 
receiving unemployment benefits or assistance j 59% of insured persons iire in this 
group. Age-old pensioners comprise a Second group', and account for 26 percent 'of 
the insured population. Finally, 15 percent aire voluntairily insured, and consist of 
self -employed persons with incomes^' below the ceiling, salairied employees not 
formerly insured, new entrants into employment at a salairy above the limit for 
compulsory insurance, and vairious groups undergoing occupational training. 

Financing of the health i-nsurance plans is generally through contributions from 
employers and employees, with the fee schedlile detennined by income/ levels. Direct 
contributions by the government aire minimal, although there are several indirect 
niethods of^ovemment assistance, such as subsidies ta the compensation funds of ♦ 
small companies and direct allocations to health jpro^ders .^^ 

Normally doctors aire remunerated on a fee-f Sr-service basft. The physicians 
^report the services rendered to the local practitioners' association, which presents 
the claims to the sickness funds and distributes the payment? due.^^ 

^^Jhe physician/population ratio in West Germany Is fairly. hlj?h, better than one 
per 600 persons in 1973." In 4965 there were 1^.5 doctors for every 10,000 people^ 
as compared to 11. 7 in \:anada, and 11.5 in the United Kingdom*^^ ,A I969 es*timate 
indicated that 5.7 percent, of the German GNP was expended on health services 

There were 3,601 hospitals in the Feiieral Republic of Germany in I969, with an* 
average of 188.2 beds per hospital. Public hospitals numbered l,3^5i private 

aritable institutions 1,281> and there were .975 private profit-making hospitals. 
The number of hospital beds' per 10,000 population in I965 was 10? j in Canada it was 
110, in the United^ Kingdom 105.5f and the United States 90.^^ 

^ A leading-edge German computer system is" the Medical System Hannover (MSH) at 
the Hannover Medical School Kospital , ant independent medical schooL,owned and 
operated by the State of Lower Saxony.-^ ^ A" major objective of the project is to.. , 
••provide-a system for the acquisition, integration, retrieval, and senalysis of 
information about hqspital patients and hoapijtal*resout*ceS in order to support 
patient and hospital management, and to provide data for scientific analysis. 
I The system op4ratQ«>a central databaii wii;h files on both magnetic disc and 

I tape storage. A Status Summary *Fiie contaiins inf o):mation- f or all patients who have 
evQr been admitted, and the system/ keeps condensed relevant information on-line as 
long as possible. Every Hannover patient is^given a ^mique ten-digit .ideftt if icatidh 
liumber; assembled from the birth date*, birth nairae, s,ex, and a running counter. 
"^This number is the ordering and search key for- the system. Several administrative * 
functions az^' performed by the MSH, including admissions and billingt 'and a-" 
pharmacy system is under dev<rlopment . . - 
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The computerized data^^base has not replaced the manual chart i thajb is used 
during the patient's stay and then microfilmed, with the paper record destroyed after 
the patient's discharge. Although t|ie computerized system' does not yet contain 
- sufficient data to be comprehensive, its contents is growing rapidly and Hsmnrver hopes 
to extend it to a complete record* 

Although less concern for -the problems df data collection and privacy has been- 
voiced by the- public in Germany than in jsom^ other industrialized nations, the issue 
of data protection, did become more- prrominent in the late 1960*s with the instiJ:ution 
^ of computerized population registries ♦ and a government plan to introduce a uniform 
national personal identifier, ^ 

Several Wes,t German states { lender pioneered in creating administrative 
protectiona, f or personal data in. computer systems. The Data Protection Act of the 
State of Hesse, passed in 1970, was the first such general statute enacted in a 
Western natiop. The Act applies to all public automated data systems under the 
jurisdiction of the State of Hesse, and its objective is to insure that data shall be 
obtained, transmitted and stored in such a way ,that it cannot be ^used*, altered, or . 
destroyed by unauthorized persons. Persons responsible for the preparation, 
transmission, storage or auttimatic processing of data must adhere to strict standards 
of confidentiality, and individuals have the right to correct inaccurate data^about . , 
themselves.^^ ' ' . O , ' 

A significant feature of the Act is the creation of an Office of Data = Protection 
Commissioner, Thi^s person functions as van ombudsman to receive complaints from the 
public arid is alsc^directed to insure compliance )tfith ^the 1970 act arid other 
regulations concerning confidential handling of personal information. The ^Commissioner 
can also set additional measures to improw data protection* 

Other West German states have since passed similair legislation,' There hajc^^ also 
been several attempts to enact a Federal law, the most reQ^^1f draft of which is, A 
currently pending Data Protection Act introduced by the Ministry of th^ Interior, ^ 
This bill would cover both manual and automated data systems,' in the public and 
private sectors. However, different regulations would be appllstf^o public databanks, 
data processing ^5y private organizations for internal purposes, arid data processing 
done^ for third parties by private agencies on a pr6fes^onal basis, such as cre4it 
agencies and publishers of mailing liats, - ». 

The rules for the first two categories are quite gene-ral, w^|^ no provision .for 
2U1 independent supervisory institution that could make^ the broa^T^rovisions of the 
Act moi:e specif ic<vand supei^se administrSl^ive compliance. Only in the last category - 
service bureau operations - is. there a provision ior outside controlt*^ut this is 
throug^ supervisors at the state ^rather than federal level* dne important r6<iuirement 
' is tha(t an individual be notified the first time data concerning, him or her is 
^ coTPfimunic^ed,^"^ | * ^ ' - 

As in most Western/ European rjatkons, the Federal Republic of Germanjr has a 
. broad deelaraxion of the doctor's duty tq^rd^main silent ori confidential information 
concerning a patient, (paragraph 300,' Deutsche Streifgesetzbuch ) There is no 
specific l.egal ban on the use of medical fnformation for secondary purposes, 
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Australia ' " * , *♦ 

In 1975 Australia passed legislation which replaced its voluntary health 
insurance system with a compulsory tax-financed system known as Medibank.^^ Before 
that, about 78 percent of the population (a 1972 figure) had been insured for medical 



^enefits and 80 percent for hospiJal benefits.^^ Under the current system, medical 
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feervices continue to be provided predominantly by private practitipi^rs on a fee-for- 
^^vice^ ba^is, but a single Governmental Health Insurance*^ Commission now provides 
re imbur s eme n ts . * ' 

Privacy issues have received increased attention in Australia in the past few 
years. The Labor Party included in its 1973 national platform a commitment to "the* 
right of privacy^. -^"^ There has also^ been debate recently on whet;^er Australia's 
accession to the United Nations International Covenant on Civil and Political Rights 
(which repudiates "uMawful interference with, privacy" aind establishes the right to 
protection of law against such interference) will raise protection of privacy in 
Australia from a State to a Federal issue, as a matter of treaty obligation, * 

The Jstycees of New Soutli Walea-J.ssued -a_wldely_-quoted~report-li5[~195B,— ^ 
"Invasion of Personal Privacy," which explored sucxi issues as surveiliance and the 
credit in(iustry. In 1975, the State of. South Wales established a Privacy , * 

Committee to research and develop a general policy towairds' priyacy. It is to receive, 
investigate and mediate in complaints by individuals r^gairding unjustifiable invasions 
of privacy! to disseminate public information and stimulate public'debate op the 
issues? and to recommend law reform and changes in administrative and business 
practice i ^ \ 

Currently the only laws .at% either the State or Federal" level protecting the 
confidentiality of medical recxjrds are statute's in , the Evidence Acts of the States of 

ctoria and Tasmania prohibiting physicians from testifying about patients in legal 
proceedings without their consent,?^ In Victoria, this privilege has been interpreted 
by the courts as also applying to the provision of written documents , ''^ 
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e courxs as also applying to the provision of written documents 
v/hen the national health insurancV "^stem^was being de^ated^n 1973-74, -^he 
problem of ^protecting the confident iali-Jy of medical recordg became the target ^ 
sharpened concern. The Australian Medical Association based part of its objection to 
'this program ojr'T^^sabsence "of privacy safeguards 'in the legislation. ^\97>t^^he^ 
Attorney Genial established a Committee of Enquiry into the Protection of Priva*<SyJ to 
recommend legiHla-t\on .tb protect individual privacy under the proposed health 
insurance surrangetoents/" ^ ■ .-r** ^ ^ ^ 

ttk December "the Committee issued a report with^recommendations conceding 

the collection and /detention of information by th^Jf^lth Insurance Commission, the ^ 
confidentiality of S\ealth data, individual rights of "access, and the security of 
health information systems under Medibank. However, thls^X^port was tabled in both 
houses of the Australian* Parliament in 197^.^-^ Medibank thus went into effect on 
July 1, 1975-without statutory safeguards for privacy. | 

A Bill was then dntrodiiced i^to the 'Federal Parliament to aiiend the Health 



Insurance Act by incorporating provisions to prjotect the privacy of individuals. 
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recommended by the Committee. Among these provisions are requirements which would 
redtrict access to medical records to person^ requiring such afcess for operation of 
. *th6^progiram, esjtablish ♦a record of every ^access, to a record that is not a routine 
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access essrential to^dailjr operation of the Health Information Act, allow individuajis 
access to their ovm records, and destroy records after a*specified time period. 
The Bill wou»ld also require persons with access to ;nedical records to protect the 
confidentiality of the data and require the issuance of a warrant in order for police 
I to have access to 'medical records/ , 

Due to the dispoluljion'^ of the Australian Parliament in November 1975» the Brfl , 
lapsed ^ However, the new government is expected to introduce similar legi^ation at 
the 1976 pari lament airy session, 

Currently, -Wedibank patients are iderttified by a unique numbering system? 
although the number is based on personal ds lalSe , such as 'birthdate , it is coded so 
that this information cannot be determined from/the number. It is not necessary to 
produce a Medibank card or to quote^ a Medibank number to obtain medical services, if » 
identity can be proved by other means. It is also possible to claim Kedibank benefits 
without quoting the Mediiiank number if the required personal* details aire given. "^^ 

Patients* claims histories are automated, with access by means of the Medibank 

number only^ ^ History printouts contain number but not name* Requests for printouts 

are monitored- by a security officer m each processing center, who ensures their 

destruction after use. Documents and microfilm' copi^ of documents are not held in 

claimant or patient files, but aire filed in order of processing which makes 
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unauthorized access difficult. 

One other event which stimulated* discussion about privacy medical records 
♦ was .a Seminar on Medical Records Systems in Primary Health Care, held in Canberra in 

April 197^ by the Hos^btals and Health Services Commission and the Royal Australian 

College of General Practitioners, The xecommendations which resulted from this 
. Seminar erajhasi^ed the ^e"ed for detailed, integrated health records and the importance 

g f ^;^^ tecting the patient's privacy while meeting the nee^s of practitioners, 

administrators, and reseairchers , * . 



France ^ • . f 

Over 99^percent of the French population is recovered by compulsory health 

insurance, either through "the general national plaji or ^peciat plans for groups such 

as miners, agricultural worker^s, «eamen*,. civil servants and railway employ^ees. 

However, coverage •^under these programs i'fe -nol; cqm^i^tfit so that additional insurance 

and private incomes also finance a significant proportion o^ Prenph health care,*^*^ ^ 

r Most of the industrial w^rk force is covered by the general scheme administered 

by /the National Sickness Insuranc'e Fund,^ which is dinectly supervised" by the 

Ministry of Public Health and Social Security and the Ministry of Finance, Jhe'Fund 

in tufn supervises 16 Regional and 121 Primary Sickness Insurance Funds, Local 

branches of the sickness funds are financed from the central general fund and are 

78 

the agencies which provide ^ash refunds to individual health care customers, 

Many benefits cov^r only pairt of the cost of-'^Tivpdical csire in' France i for example, 
the insurance i*und usually repays the, patient for medical expenses^at the rate of 
75 percent of the cost based ori the current scale of fees in the locality where the 
^earest doctor to the insured's home rfesides. As a consequence, 61,^ percent _of the 



French population belong to mutua]^ socie'tj.es to augment their coverage 
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The Benefits system administered by the National Sickness Insurance Fund is 
financed by contributions made by the employer -and employees. Contributions are * ^ 
•based primarily ^rT^arnin^cs, with ^he employer bearing most of the costs,^^ 

In 1971» approximately 5,5 percent of the French GNP was spent on medical "^care. 
The ratio of physicians in the population as of I968 was 12,8 per 10,000, with great 
^jre^ionail variation, Similairly, there were 214 nurses and 5I8 hospital beds per 
10,000 population. The total number of doctors in France in 1972 was 68,778, a ratio 

of 1.335 per 1,000 population. Of these, almost 50,000 were treating private patients 

♦ ' ' ' 82 • 

durinffi at least part of their working year. 

For »many years, any protection of privacy under French law rested on the 

generalized command of Article 1382 of the Civil Code of 18o4. This states, "Any act 

which causes injury^ to another renders the person responsible for the act legally 

bound to repair the injury." Specific provisions added to this law over the years 

dealt mostly with the duties of lawyers, physicians, public officials and other 

similar persons to preserve the confidentiality of personal information revealed to 

them in the course of theirr occupations.^^ 

A new provision dealing expressly with privacy was inserted into the Civil, Code 

in 1970* It provides: "Everyone has the right to have his private life res]^ested. 

Jildses have the power, ..t,o prescribe all measuis^s. . .which may be necessary^ to prevent 

or stop an intrusion on or into the i»timacy of private life....*' "Phis statute is 

far less powerful fn practice than^it seems on its face, however, because it is 

difficult to define in a paLrticulair case whether an action does constitute such an 

mtrusiqn. \ v j 

Currently J the le^al basis of medical secrecy is found in Article 378 of -^he 

Penal Code, which states: "Physicians, surgeons and other health office's, together 

with pharmacists, midwives, and all others who t>y reason of profession. .,.are entrusted 

with sedrets confided to thQm, except where obliged o5r authorized by law to give 

testimony, having revealed these secrets, shall be punished by JLmprisonmeht of . from 

one to six months and to a fine of 500 to 3,000 francs. 

ThisVule of secrecy is not absolute, as the patient may lift it. Physicians are 

also obligated to report certain medical facts to public sery^ces, e.^g-t contagious. 

and occupatifonal diseases, and medical records may be required for a^egal proceeding. 

Another factor complicating rulers of madieal. secrecy and* access in France is that, 

according to I970 -and 1972 decisions b^ the French Supreme Coor't ^nd Council of State, 

the files in a medical center Belon^ ^^^t t-fte cejiter itself andlnpt to ^^he, physic iari|. 

who assembled theitij the'f^efore only the doctors currently in t>racMce.it the center may • ^ 

ie^them, and -the originating physicians nay not* ^ ; ,/]' { • T / : 

In 1974, there 'was considerable furor /ip F.rancel^over reports tHa^^ a., government 

pro^ebt, code-named "Safari,^ w^s under way -to .give 5^ery pe^pfijrt in 3?i&rtce singlet . 

identification code, in cruder to f acilitate';tha quicj^ Wtri^Val^^ 

• by different data systems. As a, result of »J^iil^iic oa^^cr/,/JthV * : 

the Commission Inf orpatiqii/ et Libertes^^jGD^issiDrT on /lUtotnaiion"-8^>d . ii^^ The. / V/ 

'Commission, headed b^ Bernafd Chei^oti Wlc^'pt^sident^'br held : 

extensive hearings arid did Itudies.of the*'(lAt^irank^. m^iitt 

sect^oiis-'-tjjrreco , / 
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Its report, issued in September, 1975 1 notes the dangers in the g^vrth of data 
systems, both manual and autoraa-ted.iand points out that even without a single * _ 
ident^ifier it is possible ^to match files through common elepaents. The report suggests 
that individuals need ^o cheeky the veracity of data in files concerning them and that 
^hey should be able to correct er^rors and fill gaps. The Report also recommends the 
creation of a standing committee on data systems ana liberty •'responsible for 



medical records ^sociated with one 



supervising the negative and positive regulations pertaining to data processing . ''^^ 

A Health Committee of the Chenot Commission submitted a liackground Report on 

Medical Files to the main Commission, after studying files containing medical ^ 

information maintained by all organizations coming under the jurisdiction of the 

Ministry of Health. These files fall into three categories: 1) Hospital Logistics » 

files — 28 systems which are essentially administrative, with only minor content of 

medical information j 2) Medical Methodology Systems — 258 systems which process medical 

information with the goal of improved therapeutics, or analyze data from analytical 

or diagnostic equipment, or do ej^ldemiological statistics; and 3) Medical Dossiers — 

81 systen\s ^usually used for processing partial 

disease treated by a particulair hospital. ^ 

In terms of their potential risks to individual rights, the Health Comhiittee 

found that those in the first category, although priraairily administrative,* still 

contain sensitive personal information and need' protection. The second type, 

automated medical systems, aire ^raainly^ impersonal, but cotild be sensitive in an 

interconnected netwprk of systems. The medical do'ssiers alwaye contain personal 

medical histories, and aire therefore always susceptible to rights violations. 

,i« * * » * > > > . •* * 

The main report offered a series of suggestions to cope with threats to 

individual rights caused by data systetijs, including several relat-ed specifically to 

medical records:^ 1) the oreation of a perriii^ent board to serve as a source of 

ipf ormatior^, advice, and advocacy in matters eonceminfg automation anS^ civil 

liberties; 2) a review of the judicial basis of medical secrecyt 3) the binding to^ 

secrecy of the hqlder of a medipal ^*ile; ^) publication of the existence jof tnedical 

file systems and the identity 6f the persspns responsible; 5) the prohibition ?of 

certain uses of medical files, .with ^he clear indication of the purpose^of a system 

at the time of installaticn ;x.;lj^} th^ auihorization of certain files only after 

investip;atlon by a sUperv^sor;^ authority^ 7) the design of files so that patients are 

not excluded from information that others may share; arid. 8) a^system for -data 

verificMion by the patiept or by an independent second opinion with access to the 

^ » • ' . — go 

same information froft^whi^K the file was created. * TJiese pr'oposals are now before 

the French Parliament. , ^ - ' 

\ ' ^ ' \ ■ ' 

I .J.N 

Sweden ^ 

All resident Swedish citizens*/ are covered^y cOrtjpulsory health insurance, Prior^ 

/to 1955 » voluntary health insurance was provided by a network of^ registered sickness 
funds; since 1963i ,a comprehensive jiatio^al insurance program has |>een In effect. 
This system is administg'red by 26 regional insurance offices; these ^surev., regarded as 
independent* but operate under the central .supervision of 'the National Social 
Insurance Board * This Board^ is responsibl^no the Jjl'inister of Health and 'Soeial 



Affairs.^^ 
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Swedish resident^'-ittay enter the state* health system through any one of three- 
avenues: hospital out-patient depairtments, which account for half of all ambulatory 
consultations; district medical officers, who account f6r 25 perCe'nt of 'ambulatory 
carej and private practitioners, in vfhich case the patient pays the doctor's fee and ^ 
is reimbursed by the insurance office' for 75 percent of the appropriate amount on a 
sickness -insurance tariff fixed by the Government, Hospitalization is free to the 
patient, 90 , 

Financing of this system is also tripartite. The State subsidy covers 55 
percent of all medical benefit costs other than drugs. The employee contribution is 
a combination of flat rate and percentage of income, and the employer's contributi<>n 
is a percentage of payroll earnings, (Self-employed pfersons also make a contribution,) 
Hospitals, the district medicdl officer service, and supporting local health services 
are provided at the county and municipal level out of local taxation, * 

The number of active medical practitioners in Sweden in 1970 was 10,500, or one 
per 760 population. Hospital phvsicians form the large majority of doctors; they are 
salaried, as aire district medical officers. More than 3,000 doctors are engaged in 
private practice ^ either tot^^y or in off-duty periods. At the end of 1970, there • 
were 130,000 hospital beds in Sweden, a ratio approaching I7 per thousand population. 
All beds in public hospitals are public; unlike several other European countries, it 
is not possible to pay extra for more private facilities in such hospitals, Whjle 
there is little private health insurance in Sweden for medical costs, there is 
insurance to provide cash income" during illness, In 1971, 8 percent of the Swedish 
GNP was devoted to health caire,^^. 

f Sweden is the site of several advanced medical information systems, 0ne of these 
is the Stockholm ^County Medical Information System, at Danderyd Hospital, This is 
administered by the Stockholm ' County Medical Setvice Board, which serves a population 
of l,5*million persons and has under its jurisdiction 71 hospitals with 2p,7P0 beds^^^ 
'rfhen the Stockholm County Council decided to implement this system in I967, its' 
requirements were that the system 1) cover the entire county j 2,) be •'real timei" 
3) be modular ly designed so functional routines could be added progressively! and 
h) cover routine kTlmlnistrative^jas well as medical and- planning function#,^^ 

. SinceJ eacl? Swedish>citizen is assigned at birth a ten-digit identification number 
contaiTfLng' his or her birth date, this number was chosen as jthe patient identification 
number for'rthe system/* This tnade it^easy to obtain initial personal identification 
information* for the system from census and tax files* A Univac computer was 
installed at Danderyd in 1^68 and a second one was added in 1971. TMe , system is 
designed to handl^^ -(jhe flow of information between individual physicians, medical* 
depairtments, and hospitals thrpughout the region, 

-Tf4r6 are three\primary fiies in the system. -The Main File (on-line) contains • 
jnedical information on all in-patient visits and xiray examinations performed in the • 
cQunt^since the te^inning of I968, . The file, comprised of relevant data on all 
-presumptive patients," meaning all inhabitants of the couj\ty, includes Census 
information, critical medical information, information on previous in-patient care, 
and Hnf o!rniation oh previous X-ray examinations. The file is updated weekly from 
magnetic tapes from "the Central Ppj>ulat ion Registry , ^ I 

• ' ) ^ - 



An on-line Patient File for each hospital or^grgup of hospitals contains 
information on current patients. Th|.s data is stored only during^the time the person 
is actually a patient. A Medical Records File, containing all information from 
previous and current treatment periods, is presently still stored manually. Within 
two years, such medical records will be stor.eci on microfilm. .In addition to these 
main patient files, there are Health Controls and Home Care Files which contain 
info^^nation "on exsuninations and tests to be •performed', on results of tests and 
analysis, and on ordered therapies. A Statistics Fi^e contains selected, information 

^ ' 

from the patient files an* from* health care systems and is processed in batch mCde. 

Among tl^ functions performed by this system are information retrieval from the 
main population file, in-patieAt registration, resource sclhedulirrg and boT)kring, out- 
patient registration, laborator^^outines and waiting list. ,The system is in 
operation 24 hours a day^ with abodt 300 terminals in operation.* 

In 1970, when the Swedish public began to be concerned about issues of privacy 

and technology, the most important relevant statute was national Seerecy Act. 

This lawexempts from disclosure to the public and the prqss cer+ain categories of 

records, such as those de'aling with foreign affairs, the questions and results of 

competitive examinations, and depositions and evidence in ceurt cases t^iat have not 

yet^ome to trial. For other classes of records, such as census and tax-return 

records, the Act restricts circulation whenever the subject o^ the record has not 

given express permission for its further use. JThe- Act also provides that personal 

records of medical care, social rehabilitation aid, financial status, fsunily affarirs, 

97 

ahd the like, should not be .revealed.^/ } ' • . 

« • • 

* * rfith the publication of the 1970 census, an intense and unexpected controversy 
over privacy ar^se within Sweden. This stemmed from growing public uneasiness over 
computerizing the census and other related statistical activities that used personal 



identifiers. The two main poipts raised during this^'debate were 1) collecting data^ 
about people, their attitudes, and their lif^-styles could give the authorities a 
possibility*, of too much of cmtrol over the afffetirs of individuals r and 2) the 
expansion of automated data processing seemed to presage a super-efficient, unforgivi] 
police stata, ver^ different from the customary paternalistic bureaucracy to which 
Swedes were accustome<i. ^ 

.The»task of examining the effects of automatic^ data^ processing on traditional 
recordkeeping laws aim practices ^as given to an advisory committee in the Justice 
Department that was already, at work on the broader problem of recodifying the Free(jiom 
of the Press Act. During 1970 arvi 1971, the .Committee on Public Accesg and Secrecy 
survey e^^^^e. use of automatic data proce ^^ai ^ in both the public and the private 
sectors. "In its 1972 report, the Committee found that although public unrest about 
wide-tspread intrusion upon personal privacy was not objectively supported by t^ie 
'•eviden^i*, "the growing use of the/ computer in gathering, storing, processing' anfl 
disseminating^ information about people was introducing sufficient changfis in zne 
nature and power, ^f administrati/on so that new legal measures of control were needed^ 

"The Committer pr:esented. draft legislation designed to regulate, the- effects of 
computerized record keeping whil^ allowing the rationalization that automatic data 
processing is capable of bringing to complex administration. 
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The Swedish Data- Act was passed substantially as drafted ar^ became law on 

July 1, 1973, to take effect on July 1, 1974. . 

• ^ Undej: the Act,_every business or govemmen$ agency wishing to^ maintain a 

c^puterized file of information containing data which can be identified with a 

particular individual must first obtain the permission of th^Data Inspectorate, a 

nine-member public body appointed by the King-in-Council. The Data inspectorate 

grants p^rmissi^n to operate a personal file system if it finds there is no reason 

to expect it to create undue risk of intrusion into the privacy of the persons 

registered. No licensed system may store medical or criminal-record data unless it 

is authorized to do so by law or this has been specifically approved by the Data 

Inspectorate, ' . ■ ^ »« 

^The^ct defines with considerable precision the duties of the "responsible 

keeper'^^of each registered file, "^e is liable for criminal penalties provided for 

violation of the Act; ^he - responsible keeper must furnish any data subject, upon 

request, with a complete copy of all information about him or her contained in the 

file, unless — as with certain jedical and crim;inal data — that is expressly prohibited. 

If the personal data are fc(und to be incorrect, the keeper is obliged to hava th^m 

corrected I if incorrect data have b^en disseminated by the system, the recipients 

must be notified of the corrections, v,,,^^ ^ 

The Data Inspectorate, in addition to acting as a national licensing bo4^, is • 

also responsible for supervising and inspecting registered systems, as well as 

» * * 

serving an ombudsman (citizen complaint^ function for all government data-processing 

activities, ^ ' 

Because the Data Law of 1973 and Swedish automated nredical record systems 
developed side by side, an^ equi/ibrium was established from the early 1970*s onwgird 
betwefen the goals of the medicalV^cord keepers and the requirements of the law. 
Therefore, passage of the Act cause\ little fundamental <:hange in medical record . 
keeping, -» 

Decisions of the Data Inspectorate on licenses for new automated medical systems 
have established several main points. First, the information that is usually kept in 
typical medical records may be automa^teHfunless the amoijht of information is so 
^extensive that it constitutes^a compreh^hsive description of an individual. In such 
'a case, the personnel who have acces^to the system must be sworn ta secrecy, and 
breaching that duty carries criminal penalties. Second', information collected 
especially for a medical system muat be given by the patient under. a clear 
understanding of the purpose and scope of the system, | Third, 'statistics producexi 
by the system must not disclose any information aboutjan identifiable , individual-. 
Fourth, the sptem*Thust be used only for the purpose Stated in the application, and 
only the approved data and processing steps may be used. Fifth, systems used in 
support of a particular res^ch project roust be purged when 'the project ©nds, and^ 
the permission "granted by the^^ta Inspectorate in such instances is valid only for a 
stated period, % - 

In eases vfher^ a medical system raises unusual pt^ob3.ems due to" the sensitiv*ity 
of the information, the Data Inspectorate .has not hesitated to mandate stronger^ ^ 
safe^u^dd.. For example, Where a research project to evaluate the sucpess of an - 
alcohol clinic would gather much of its data through personal interviews With the 
patients; the Inspectorate set especially thorough requirements for informed consent. 
^ . - " ' 263 
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■ Accorditig^,to the Data InspectoraW; the most sensitive aspects of medical- 
records so Tar have involved political quest5.bns connected with maintenance of the . 
immigrant children •s medical register', and Ifegal issues connected yd.th a naircotics 
register* In-- the latter case, the Inspectorate is aweire that police do get 
information from automated systems on Qjccasion, even though thif is not permitted^ 
since this police access has been infrequent, on a verbal basis, and accomplished 
through the cooperation of naircotics register employees with authorized access, the 
Data Inspectorate does not feel that this" problem '^can be solved by altering th^ 
conditions of autiDmated files, but j>equires strengthening the supervision of reg'ister 
employees, ' * * ' 

SUMMARY 



Looking at the overall patterns of "computer use in health care in other- 
democratic nations , we can draw the following conclusionst * ; ^ 

. (1) computer -use- in Europe and other industrial democracies is still heavily 
centered on administrative and laboratory applications for hospitals, and ^ . 

administrative and claims-processing operations for health insurance purposes! 

(2) leading-edge hospital systems are st^ill experimenting with their work on 
automated pati^t records and patient information systems? 

O) o^l^y a smal'l number of c^linics and hos pi tals_J.n_ various nations are wo;rking, 

slowly, toward a unified hospital information system; 

(^) there are only a few working models of regional health information system^l 

(5) problems of cost- justiJication, organizational and medical opposition to 
technological innovation, and competition between medical and socia^l. priorities for 
money and management attention are pairt of the basic scene in all tnese nations i and 

(6) national health information systems for planning ♦and public health purposes 

are still in their infancy. ^ . 

In short, while computers have aided in administrative aspects of health care, 

and have made some valuable contributions to direct patient services in othgr natj^ons 

the fundamental problems that have impeded greater use of and greater payoilf frojff 

computers m American health care have been duplicated in other nations, and remain 

the issues confronting all health system plajiners today. * > 

* As far as protection of citizens rights in medical data, and especially in , 

' m/V 

automated data systems, there are several models of legal protection emerging amon^ V 
fhe industrialized democracies, paralleling the way such nations are dealing with ^he, 
larger records-amd-^privacy issue in their societies, %i 'terms of what has already 
"been adopted, one model is represented by the Swedish Data Act and similar regulation 
at the West German state level. Here, automated personal data systems are being' 
officially licensed, with detailed regulation and continuing oversight assigned to 
fedmin is tractive boards or commissioners,. Medical data systems in these icountries 
represent one type of system colored by the! general protective scheme, jso that the 
definitions \f privacy, confidentiality , and individual access'j and the / safeguards 
required in su^i ^stems are being worked out by the regulatory authorpities as 
initial licensing, practical experience, and citizen complaints develop^ 
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In most other industrialized democracies, national legislation to protect priva^ 
had been recommended by parliamentary or special commissions and\s currently under 
legislative consideration, with adoption of various schemes reflecting different 
national political cultures virtually certain by. the end of the 1970 's. In some 
of these nations, specific safeguards for national Health insurance data or data kept 
by primary care providers have been recommended, as in Australia, and such measures 
will probably be adopted sepairatfily. f * * ^ 

What is especially worth noting in this situation is the< widespread agreement 
in parliamentary democracies on the principles of citizen rights in record systems 
that need to be observed, whatever regulatory mechanisms may be chos^Jn to -enforce* 
them. There is general consensus that data systems should be limited to ?he 
information necessary and relevant for the funo-tiori being performed, that data systems 
should not be secret, that individuals, should have appropriate notice of the records 
kept about them and of those who will have access to the information; ^ and that^proce- 
dures should be provided to allow individuals to inspect their records and assure their 
accvracy and completeness. As to the special regulations needed for computer 
systems, the British White Paper of 1975 expressed what a decade 9f alarms, studies, 
and .public .debates has now made a common outlook in Western nations i ^ 

^ "The time has come when those who use computers to handle personal information, 
however responsible they are, can no longer remain the sole judges of whether their 

ovm_„syat£ma„adequately__saf^ard privacy. The safeguards must become subject to 

independent scrutiny, ** ' . ^ 
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• \ CHAPTER 13: POLICY ANALYSIS AlTD RECOI-IMENDATIONS 

.INTRODUCTION 

To set the perspective for our policy analysis and ■recommendations, 'three 
Suamary observations are' important: 

1. Medical records and health data are being used. today in an enormous variety , 
of setting's, with computerization present in all-^>f them. Cur report has traced -\ 
such use in doctors •• tff ices , clinics, health centers, and hospitals; in governmental 
and private facilities; in acute and ambulatory care; in physical medicine and 
psychiatric treatment; where patients could choose their health care and where they 
are under va.rious institutional controls (prisons, the army, mental hospitals', etc.). 
.We have seen that beyond ^imary care lie important uses of personal medical data 
for service-payment, quality-care review, and all the social processes we discussed 
as Zone 3 activities, from credit, employment, and licensing to law enforcement, 
apcial research, and poli/tical life. . ' 

Given this grfeat diversity of settings, there ts no single public-policy 
intervention that can be expected to ^set standards for the protection of citizen * 
^ghts throughout the health care .sys'ten and ^covering all other health data uses. 
No constitutional ameftdnent, model statute, judicial rule, systems guide, or 
Managers' code cotad encompass, by itself, all the important problems that need if— 
attention, ^nbr would the actions of any one of these policy- forming. authorities be ' 
adequate in te.^ms of regulatory scope and supervisory power. Thus our initial 
assumption's that wise st^^ards will require a mosaic .of policies, applied by • 
differyit authorities and 'institutions in oar social system, hopefully adding, up to ' 
a consistent national approach. 

, 2. Members of the. project teain' (just as readers of this report) hold differing 
views about how American health care should be organized,' financed^ and condLted, 
as- wen as on- the issue of where computers can' and cannot be used to good advantage ^ 
in 'the health-care process.' But* we take it to be^a paramount requirement of 
American society, based on its concern for individual dignity and humane values, 
that citizen rights should be adequately protected regarMless of the health-carl 
• or computer-system options that may be pursued in the coming years. To be sure, 
some models of health care or information-system plans lend themselves more easily 
than others to the installation .of civil liberties guarantees, and there are some 
systems (current or proposed) that are so potentially violative of citizen rights 
that they deserye to be opposed entirely. But,\s we see it, our , objective should ^ 
be to assure that every institution now collecting or using personal health data 
observes basic guarantees of individual rights, and that every reform of our health 
care systems or adoption of new computer applications in this field demonstrate how 
it will follow similarpoUcies. We cannot al?bw such issues of citizen rights to 
become matters for "later consideration," to be seriously addressed only after 
"more basic issues" of health care are resolved. 

3. While' the need to protect personal medical data against misuse has been " 
. -recognized recently by influential voices in the medical, computer, ^d civil 
liberties communities, and while we are beginning to apply importan1?new laws such 
as the federal privacy act, we have still not moved very far to bring health data 
systems under a set of, guiding principles and procedures. To reiterate what we 
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said in the conclusion to Chapter lit 

"Most computerized health data systems sire .being created or 
^ expanded without sufficient consultation in .advance with^group? 
re presenting* citizen rights and doctor-^patient interests, and 
without some kind of proceeding ^pen to the. general public, 
yost data -systems lack sufficiently developed analys'^es, of how ' 
much and what kind of identified personal da.ta they really 
need to perform their function. Even. when properly defined, ' 
most da!ta systems fail to adopt sufficiently precise standairds 
of confidentiality, controlling uses within\ the "organization 
and release of identifie'd data to third parties. When it comes 
to rules for permitting patient access to their own records, 
very feyt computerized organizations ^have adopted procedures 
^ responsive to those patients who ask for and insist upon / 

access .. .What we have today are ambiguous and ill-defined 
systems 'that ieave people uncertain and feairful ab6ut their 
capacity to control the circulation of their medical and health' 
data," ' . ' , , • V 

* t 

In short, while we are not without some useful precedents and tools for, the 
job, securing individual rights in the increasingly computerized world of health 
care is 'a job that has barely begun. ' . • * ^ 

ELEMENTS OF A NATIONAL POLICY ' * • ^ 

To evcVve a/unifi6d national polipy^ we need to. (A) adopt a coherent theoretical 
approach to the ^balancing of ' individual ^d social interests in the^use of data 
systems I (B) apply these to produce basic principles or standards for the operation 
of health data systems; and (C) identify some current priorities for.px)licy action in 
the health area'. These will be. the major sectdonB of our discussion in this chapter. 

A. GfiNERAL CONCEPTS' GOVERNING DATA SYSTEMS IN IJeMOCRATIC SOCIETY v ^' 

Looking over American society's encounters with the privacy-and-databanks 
issue during the past decade, we see t^e^graciual emergence of a set* pf basic concepts 
that command .a wide public concensus today, and can .be* 'drawn upon. with great value 
in making policy choices in the health*/ield. Since these ideas have been discussed 
.at great length elsewhere, we^w^ll prese^nt theip only briefly, in. the eJSpectation 
that probing their conceptual strengths and weaknesses,, an'd applying them to real- / 
world situations, will be y/e work ahead for many^ye^ars. ^ / 



Vsee, for example, Westin-.and Baker, Databanks in a ^g^^e Society Tn.Y.i Quadrangjle, 
1972) a&id RecordStC omputers.^ and th6 Rights of Citizens , Report of the Secretar:^»s 
Advisory Committee on Automated Pereonal Data Systems, U.S. Department of Health. 
Education, and Welfare, July, 1973, DHEW Publication No. (OS) 73-74. / | 
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--hV. i:Hrj^c^t^act^^ theory of i:nformarionar^privacy ' 

- ^ -I-tv a d^iocj^tic society, which seeks j{o assure both individual freedom and a 
rationally-ordered social system, the w^y id whach personal information is treated is 
of special importance. The traditional advocacy of privacy rights m information has 
been couched largely m civil-liberties termiijology— the right of an individual to 
determine, in most circumstances, what information about him is obtained and used by 
others. But at least where organizational data systems are involved, there is growing 
recognition of what might be called an exchange theory. The concept here is that an 
individual, exercising his right, to give or withhold personal ikformation, releases ' 
valuable personal data ei^ther in order to obtain a specific benefit for himself {or^ 
his family or group, or to promote a social good he supports) or else to fulfill a 
legal duty (carrying the sanction' o'l' majority will under democratic theory). In 
return, 'the recipient (the data user) 'ifes two basic obligations:^ to use the personal 
information only for tfhe purpose agreed upon (unless authorized by additional consent 
or fey lav), *and ^t to^ treat the information so carelessly or maliciously that it 
harms the individual from whom it was obtained* 

Ahat this exdhange or contract theory of information privacy recognizes is that 
^rsonal information hae become increasingly valuable in our data- based civilization. 

personal characteristics, once thought of solely civil libertarian terms as 
entitled to protection- against ^(ffiwonted su^rveillance or disclosure, have become the 
vital raw materikl of business, Ju^ernmental, aid political decision-making: age, 
marital status ,^ children, income, race, education, buying habits , political 
preferences, religious denotations, health conditions etc. If individuals were to 
withhold such persTonal infoi^tion from those who daily ask for it, business and 
governmental affairs would be seriously disrupted, since organizational planning, 
administration, and evaluation depend heavily on access to such individual data. Thus, 
whatever it may have been in earlier centuries, personal information has become, like 
clean air and water, a sc^ce commodity today, capable of being valued in an economic 
sense alongside its social worth in terms <&f protecting individual dignity and 
democratic values. 

Ifeking informational privacy a property right as well as a human right does 
something useful in a capitalist society: it l^uttre%pes the individual's claim to 
assert (or at least to share) control over the uses made of his or iier valuable 
property. It also explains why there should be a reciprocal duty on the part of the 
data user to live up tb his side of the informational contract not to be guilty of 
unjast enrichment at anoth^r'^s expense. Whether as a basis for legislation or 
judicial decision, or to explain to the public the implied-contract relationship that 
should be seen arising between data sulbject and data^ user, this concept has great . * 
merit ^dr public policy.* 



r \ 

♦This formulation pajaliels the concept of "mutuality" used in the fair information 
practices literature. For a recent discussion of this concept, see ^ohn P. Panning. 
David §.H. Martin, and ,Susan Bennett, "Pair Information Practice for Health and 
Medical Records," a paper prepared for the Conference on the Confidentiality of Health 
Records, Key Biscayne, Plorida, Nov. 6-.9i t974. ^ . ^ 
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2» *The special dangers of automated data systems 

After two decades of experience with automated data systems , we should recognize 

* 

that these are mechanisms highly subject to surprise. Anyone who has followed the 
rapidly changing technology of computers and communication systems knows that these 
enormously powerful tools have — in the hands of human users — consistently done either 
unexpected things or expected things in unexpected ways. Each generation of 
computers has these "bugs"" worked out, but each new generation of computer- 
communications technology also brings new operating principles and new constellations 
of hardware and software that create new "bugs" to be resolved. " This is not to say 
that computers should not be used, or that harm must be taken as inevitable . But 
until we are much farther down the road to a stable and disciplined .technology than we 
now are, we must constantly take it for grsuated that automated systems have a 
propensity^ to gp awry. Where yisks to citizen rights are involved, this c^ls for 
speciaJ- attention m the planning process, and close monitoring on a continuing basis, 

5* !Bhe emergence of the "data keeper" concept 

' ?or practical as well as legal reasons, it has become clear that the organization 
that owns a data system is the party responsible for its ethical use. Others may 
share that responsibility (someone el^e who funds the venture, regulatory-agencies, 
etc'), as- well as those helping process the data for the owner (e,g, , a compute^: 
service bureau). But a non-transf errable set of duties attaches to what tK§ Swedish 
Data Proteq^tion Law calls the "keeper". These duties run m two directions — to the 
individuals about whom the data relate and also to the larger society. The latter 
duty arises because the operations of major data systems affect more than the data 
subjects; their operations affect the general public which hears about them, and will 
also contribute to general norms of organizational responsibility Tor irresponsibility) 
in the larger society, ^ 

A , A legal duty to take reasonable care 

We have already mentioned the ethical duties of data system keepers. What seems 
to be evQlvxng gradually in the privacy- and-d a tabanks debate is a general standard by 
which to measure the performance of those ethical duties, and to transform these into 
legal* obligation. Simply put, this says that any organization which creates a data 
system that does not provide adequate policies to safeguard citizen rights and does 
not utilize .appropriate data-security measures, creates unreasonable risks to society's 
interest in protecting individual rights, and should be held legally accountable for 
its failure to tsdce such measures. " ^ - ^ ' - 

This notion- reflects the classic "reasonable man" standard used by Anglo- 
American courts to measure liability in tort law. It rests on the astsumption that tl^e 
creation of automated information systems is generally a valuable activity for 
society but that it also generates foreseeable risks of harm to .personal and property 
rights. .To deter such risks of harm, there could be s"^tutes or regulatory-agency 
rules spelling out what constitutes adequate policies and appropriate data-security 

*Fot a good presentatilDn of this view, see J, J, Hellman, Privacy and^^lnformatlon 

Systems*, An Argument >a|aid an Implementation, Rand Corporation Paper, p-4298, May> ' ' 
^ lyVO, p, b'd. I %7 ~~ 
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measures for a given type of record-keeping activity or field. But. even- in the 
absence of such legislation, the standard might be applied by courts under the common 
. law, to hold organizations liable for damages or subject to injunctive order if they 
had not followed the standard of care considered by the. courts^^to be rd^sonable for 
their industry or governmental function. • ^ , * * ^ 

-General requirements for demonstrating "reasonable care" 

It is clearithat the proper balance between claims oS^ citizen rights 'and 
organizational needs for personal information will vary from area to area. But- in 
every field, we are beginning to recognize that certain general standards should be. 
- observed: 

A. Only information relevant to the organization '5 legitimate purposes should 
be collected and stored, and the definition of relevance must respect both 
constitutional guarantees of privacy and prohibitions against making* improper racial, 
sexual, cultural, and similar discriminatory decisions. 

3. ?he managers of a data system must take adequate steps' to insure, that the 
records it keeps are accurate, tijaely, and complete, as measured hy: the kinds of' 
uses -made of the data and the social impact 9f their use. , " / 

C. Detailed rules of confidentiality sholild govern who within the organizati'fen 
maintaining the data system has access to a record, and this should be based on a . ^ 
need-to- know principle. * - ' . ' 

D. Disclosure of personal data Outside the organization that co-llected it" should 
be made only with the informed and voluntary consent of the individual, obtained jit 
the time of collection or by subsequent query,, pr. under a constitutionally-valid legal 
order. ' ■* , ® 

S. An individual should have a right to seB his or her record, and have an 
effective procedure for contesting the accuracy, timeliness, and pertinency of the 
information in' it. There may be some exceptions to this right of inspection, in 
the interests of protecting cbnfidential sources, but^these should be rare, and never 
allowed if the record is used to make judgments afjpcting the individual's rights 
and. , benefits. ^ . * • 

\ <f . ^ 

6- The" requirement of public notice ' . ' * .' 

The concept from the HEW report that secret data systems should not be used to' 
make judgments about people has been widely accepted. But beyond announcing the 
existence of all personal data systems lies the need for society j;o have the creation 
and expansion of dat^ systems reported to the public in ways that .indicate 'their • 
potenti'^ iapact cq citizen rights, an'd thaH provide the basis , for "info'med public. . 
discussion of such impact. This vould be the equivalent of-'the ."envirSnmentai impaci" 
statement developed recently by federal and state law/ The review .of such notice 
might.be lodged under a. variety of supewisory atfEhorities depending on .the 'field 
involved, and there would have- to be different standards for different information 
systems, 'what is critical, howeVeiv, is to establish' the principle .that creatian of 
personal data, systems is .too 'important . to- tfea,t as '^^internal. management .prerogative. 



Thie concept of independent review ■ - ' , 

Finally, 'the operations ♦of evisry personal data system ^ought to be sc^ject to , ' 
y^gula^ inspection and evaluation by some kind' of , outside, independent .body, such aa' 
a professional licensing association, regulatory agency, or governniental commis3ioj;i, 
In aan^ cases, th'at J.nde pendent body should be ei^powered to hear individual com|>l.'aints 
about the operations of the data system, and to exercise an ombudsm^ fiinction where 
such cohplai^ts :have validity, ' ' . ' ' ^' 

?h^ concepts just discussed represent a theoretical, ^framework for insuiu.ng that 
the operations of data systems are consistent >ith citizen i:i^hts inia \ \/ 

» deaoci^atic society. For oilr purposes,' the challenge is; to apply t)ifeir ,ge|^eral ideas 
^^0 t'ke special ^conditions of health care, and to the leng|;hening usjes;.af health data, 

♦ t^roughiiCit Anerican society* 'It is to that task that we turn no«w/ ^ , '/ ' 

."^ ' , ' ' ' • ^ ' ' ' ' 

B, APr^xI^rcr ^-CJi: aC::cZ?T^J .X H3AL?H DA?A,CYSZ2I-IC:. ^ 12 3A3IC PRINCfPLES FOR HSAI/TK 

DA2}A,SySTE>iS ;^ : . o ' ' . ^ . • V : , '' 0 ^ \ ' ^ ' 

, • ■ ' " • ' ' »» ' 

tDjreoer.t, ^here. is \\n tuiQven fit between these ooncepta for the proper c&ndaq.t . 

Qf lata syzzenz jind the way that Anelr-ican lav and social practice deal with", ^:,ealtK\' ; 
>^ da:;a. Historxcally , the duty of physici-a-ns to 'keep patient data confidential, as it 
\s^ceQ ir* zhQ Hiopocratic tradition, was?. a valuable recognition of the need for f.rank 
conziun^<;aiibn ty the pcvtier.t ta th^ phy^i^cian and observance, of conf ijlentiaiity, ' . . . 

vis a vis the outside world. But the Hippocratio tradition also embodies .the. ideas ' ' " 
that thysicians mi;^st protect the mysteries of the medical profession from commo3 view, 
as Well as to inford the ^ patient only of what the"^ physician fee-lS the patiebt ahould 
know ab^t his/he^ medicij^ condition. These elements of secrecy* smd unil^tej^al * 
; (|^cis ion-making are no^ cbnsistent with, either citi^ien-^right^ concerns or the growing^ 
'^/'partnership"^ theory of ddctor-patieilt relationshiVs, a b'yv health- consumer , \ ° 

movements, tFiirthermore , , cUxre^^^ and practice as to cftrctilation 'dff patien| cl^ta^^ ' 
beyond trie, primary-care fadility (through ^r^leases ^ and 'implied-- c^onsent .^,octrines) 
leave 'much to be. desired , as do tfie weak statements as to "conf id^ntiaiity" that * / , . 
^ apt)ear in ^lost sta-^ute^purp^prting, to, protect' health d^a when this is cbllect,ed for * . 
social tises. ^ ^ ' > ■ v . >^ . ' . ' ' " — • 

What then sho"uld be'th^ principles that are^applied to thd, use\of medical reco'rds » , 
and. health data? We will pred^^nt here .12 major principles t&at we ^hink neei'tp be ' . 
defined and applied whenever, ah automated data system is ^used in the bealth system,^ 
While ve focus on automated Sysftem's siac^ that xeoi^esents the special interest "of . 
our study, most of the principles that ye^discuss would, apply ' alfeo "to manual 
, systems, and should be helpful to those '^^nvolved J.n those operation^.^as well. 

Wherever possible, we will ilii^strate policy ^aliierrlatlves' with, examples of 
organizations that we found presently jfollowing sucjfct innovative , or "exemplary- "\ , 
approaches. 4n thi& way, jie iibpe\to show that recommenced s$ej)ar are not Utopian . \ 

proposals »but policies^ that can be\ successfully and practically instituted by ' , 
organizational managers. ' . ^ 
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\ ; R^quiriftj!. Public Noti<5e and/Impaot Sj^tements 



y ^i^^feneve'f''^ -^lut ornate d data: system withA'dentif ied personal\ records is to be 

* created* tor heaUh care,- service'-fpayment; quatilty-assUrance , medical research, .or 
^supervisory administration oyer.health care.,~^noti«ce should be f iled -i^ith" ^in ' 

appropriate pi/tside authority and^'aommunicated to any c on tinuingi* population of 
\ .*indi^^idu^ls whose records will b^ g*f/ected. A procedure should be provided for 

interested persons and groups to appear and m^ke their views know on th^ proposed \- 
^.data aysteipj especially as to the adequacy of its measures, to 'protect citizen rights, 
^^o Jel»p fpcus that public disicussion, thV organization 's notice should include a 
^' ^ '•privacy iirtpa'g^t" statement describing the'ways in which the proposed automated data 
Vsys^mVould affect existing policies and procedures relating to, citizen rights%in 
^that organization's use of .personal da*a. . * ^ ^ * .- 

Discussion ' ' • ^ ^ ' 

• The, notice concept proposed here is similar t© that now required of federal 
afeencies undeV the Federal Privacy Act V 197^. It rests on the belief t>iat the 
creation of ^an' airtojnated data system is of efficient impbrtance to the i-ndividuals ' 
affected,^ to public confidence in the health-care system, and to democratic socy.ety"' 
. as a; whole that it ought not to'be carried out through internal* managerial decision- 
. making, lik^ -ordering a new photocopier or changing the paint color in the hallways. 

The content of the notice would vary' somewhat, depending on the type of 
; orga^izaiiont involved. X However* jlts basic elements ought* to. include t the data 

tern's purposesi the types of Information to be collected and stored;^ the regular 
> uses intended to be'^made of the datai the rules for con^f identiality and data-access 
within the .organization > the rules for releasing identified .datst to'outsiders i the 

provisions '^gr access to and review of;tJjeir jfe^cords by the data subjeatsi the - 

^provisions 'fdr assuring accuracy and timeliness of data, and purging stale datai and 
the data security measures^to be followed,* 

* * A notice system of, this kind (pu\>lish,ed in the- Federal Register ) is already 
ma:nd^t«id by^the Federal Privacy Act for federal agencies, ingluding those involved 
in health activities. , However, no ^privacy' impact, statemeht or advance notice to data 

^ populations are required' in that legislation nor is there ahy federal commission* or 
regulatory agency empowered to'appt^ove V' disapprOyfe ^.data system plan. Notice 
requirements sip^ilar ^ to Dthe federal act are used in the f ive .stktes tiiat have passed 
•fair information practices acts for state and*local govejpni^ental agencies. How well' 
such notice systems are wokdng so far, and' whethe>-oentralized review ought to be 
J ,, instituted ,are' issues we will discuss latei^ in this chapter. 

^ ^How private health organizations and all. state health* facilities could be- 
brought into a notice fend impact-state?nent system raises spm'e difficult policy 
' issues, especially as to the body that would receive the notices and the kind of 
' hearings: pro&ess that would be conducted. The? alternatives range^from *the most 
voluntary optip>i$ to the mdst^ regulated ones, " ^ 

A:t t}ie voluntary dnd^ of . policy spectrum would be *a system that required 
. "org^ni.'zatidns simply to issue the notice, puiaish*'it in a reasonably access^ible . 

place; receive whatever reactions might be forthcoming during a waiting period, and 
' then adopt whatever, the jnana^ers consid^pred^^kio ife yseful suggestions in .the 
^, implementation, of the sys^tem plan, > Vj* - 

' / " . * , 275 




296^ 



K more supervised approach would be for some private body (suQh as a coritoilspioh 
comparable to the Joint Commission on Hospital Accreditation), or a state health 
agency, or state fair information practices commissibn, or the federal Depsirtment of 

* HEW, or a federal privacy commission, to be designated by 'legislation tO' receive 
such system notices and hold formal heairings on them.' This pl'aii would not lodge 
decision-making power in the central body buf would see it simpiy as a collector of 
notices and forum for responses, jJossibly with a recomrtendatory role. 

1 Finally, the notices could be handled in the manner of, the Swedish Data' 

Protection Boar<^ which licenses all automated data systems, governmental or private. 
Under'Swedish la^, every J\ospit^l, health center, health insurance boaird, d'isease 
registry, or medical research project mwst furnish the ki^nd of notice described 
above as paft of the registration process, and the Data Boaird must approve the 
policies and safeguarcjs before a license will be issued. Any one of the three 
authorities already noted — a private body, a state agency, or a federal agency 
could be given such regfstration-^ype authority for health data systems in the 
United States. 

Tfe.flj^re are pros and cons in eacH of these alternatives, A national authority 
that had approval or disapproval power in the Swedish style would represent a iacge 
extension of federal supervisory authority over the operations of privWe and stat^ 
health facilities, with risks not only of over-rigid federal controls but also of 
potential misuse of power by federal authorities. How such a commission staffed 
the President's men would have helped in Richaird Nixon's quest for, derogatory data- 
on his ••enemies** must be in the minds of, anyone considering the creation of a 
, federal board having control over the future .medicaj record systems of the nation. 
Even if such a federal body were given only the authority to receive organizational 
notices and conduct hearings, or issue advisory recommendations,, tjii^ would give 
the federal agency a considerable leverage over state and private health 
orgamizations • 

On the other hand, while looking ^to state-government authorities to regulate 
themselves and private organizations would have the value of keeping supervision > 
closer to the locfil 16vel, and decentralizing supervisory power, it would probably 
involve a lengthy period while the 50 states enacted such measures, as well a*s the 
likelihood of inconsistencies in standairds from state to state. 

Going the private -commission route^ for private health organizatiohs has the 
advantage strengthening private autonomy and f osteringv self -regulation, and 
would probably be supported" strongly by the 'private sector if it felt that government 
control"* would^ otherwise be enacted. However, the ability of a voluntary organization 
tq, enforce standards is often quit^e limited, and many critics o$ the Joint Commission 
would say that its rectrtl'^demonstrates just that point in the hbstjital f i^ld. ' 

It may well be that most individuals will make a policy xhoice. here based on 
their general philosophy about governmental pdwe'r and* private autonomy, as well as 
\ their preferences between federal and state roles in the political system. Some 
•observers may wish to reserve judgment temporarily until s0|ie experience has been 
recorded as to how federal agencies have fared with the public notice ^Requirement 
of the federal privacy act, "to see whether more state legislation begins to fill 
the current' regulatory vacuum, and whether private health organizations adopt such 
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public notice techniques^ as a mattei;of voluntary practiq^e/ For the purposes of^ 
this report, the principle of publig Th^tices and impact statements has been presented 
as some thijyg^hat' ought to be done, whatever the particular authority that may beT^ ^ 
installOT^to administer the process • \ ' * 

Another element of the notice system proposed here is that any ^continuing 
population.of individuals that will be affected by computerization should receive 
clearly-written description of what is proposed before the data system is installed • 
This-wo^uld include familio^egistered^ at a community health center such as Martin 
Luther King Jr., subscribers to health insurance policies, person^ working for an 
industrial corporation automating' its' employee health data, and similar groups. - 
This concept assumes that individuals have a right to advance notification, not 
merely a statemen^^f what has been done. Any person who might feel so disturbed 
at how this d&ta System w^s being set up would then be able to assert his* or her 
complaints, raise issues publicly, and, as an ultimate step, 'withdraw from being a' 
patient, policyholder, employee, or other participant in that organization's" 
^affairs. , 

This idea of advance no'tice may seem excessive to som? observers, iilvolving ^ 
some costs in money and delays in schedules for automatioxij But humane, health care 
involves unique concerns about the trust and confidence of" patient populalficms in' 
those who' are providing them with care, o^. paying for health services. ^ As we look 
ahead to the increasing use of automated health care records, lifetime patient ' 
histori'es, disease surveillance registers ^ and other potentially valuable uses of- 
I ^information technqlogy, assuring that patients feel "they have meaningful control 
•ovei^what is done with their information,, including a right to opt out^ of one type 
of' record-keeping system and lo choose another that better suits their values, 
represents afi^ important st^p in democratizing the uses of technology. 

^* Setting i^bper Limits on the Collection ana Kecording of Personal Hellth Data 
Principle 

Ail organization creating a health data system should examine whether the 
collection and/ol* recording of eac^ element ^of personal health information is , 
essential for carrying ojit the organization's proper functions. Socially-acceptable 
standards of relevance and propriety should be worked out for the data systems in 
each o; the three zones of health data use, through public discussion and appropriate 
policy- setting mechanisms. 

Discussion ' , - , 

A. Primary Care; Zone ^ 

Where primary health care is being .provided*, from doctor's office to clinic 
and hospital, we saw that th^ current trend is to collect and record a wide range 
of* information about the patient, including personal and family history^, social 
activities, alcohol and drug use, sexual patterns, emotional $nd psychological 
problems, and mucH other sensitive data. Computerization leads to more systema^tic 
recording of these data', and their ajvailability to pb'rsonnel (other than physicians) 
sharing in the primary-care process. ^ ' ' \ 

Since extensive disclosure by patient to health professional is voluntarily . 
given, is needed for effective care, and is the area of confidential communication 
best protected by existing law and social noi^Sj^many thoughtful leaders in the 
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health field, including some who are strong advoaates^f consumer rights and civil 
libe^'ties in health care, urge* that '^ew privacy rules ouglVt to avoid ariy intervention 
as to what is collected for primary dare. * Dr. Lawrence Weed, fo;r example,* argues 
that too little personal and social data is usually collected today in primary care, 
not too much. In his own facility in Vermont, where an experimental automated 
problem-oriented record is being used, the data-collection forms and progress notes 
produce an extremely detailed personal, social, and medical history for each patient, 
and Weed sees- this as a vital part of a patient-oriented health-care process J Both 
from principle and experience, therefore. Weed is sti;;pngly opposeifi to law or regu- ' 
' lation setting relevancy limits on what 'is collected or recorded for direct patient 
care. 

The acceptability of Weed»s position may well turn on what other rules' society ^ 
• is willing and able to apply to the uses and flows of such health data from primary 
care. That is, if patients are given the right^to know what is in their primary 
care re^cords , if their voluntary cdnsent is required" before information is released 
from those records for all uses beyQnd primary care, and if the law were to safeguard 
such data far better from compulsory disclosure for non-medical uses thetn it now 
does, then society could take a favorable view ^ Highly- sens i five personal data 
being recorded in jjrimary care data systems. But if these policies and safeguards 
are not installed, then the' claimB of pri^nary care facilities to ^record «uch 
extensive, sensitive information must be evaluated in terms of their likely uses 
and exposures beyond the care facility. 

We will be discussing how to deal with patient access, informed consent, and 
, social uses of medical records, in lat^r sections. What needs noting here is that 
society simply qannot accept the health professi^^nal ' s plea for unbounded data 
collection and full recording in data systems unless there are iron-clad guar^tels, 
enforceable at law, that the patient's rights, benefits, and opportunities in the ^ 
larger sX)ciety will not be harmed by production of his or her self-revelations from 
primary-care records. This means that all health professionals who seek ti^e advan-' 
tages^ of extensive data collection for primary care ^ill have to commit themselves 
fully to the installation of legal protections for those data, or else risk puj)lic 
oppositioji to such systems as creating top great a. danger for citizen rights. 
Service Payment and Quality-Care Assurance 

When standards o*f relevancy and propriety .are sought in the area of service 
payment, we must treat' the underwriting/eligibility process separately from the 
claims process. In underwriting of private health insurance, society has — until 
recently — allowed Jbhe profit and non-profit firms to use whatever standards they, • 
wished in selecting persons^ to insure. Since there was thought to be no Ifegai "right^' 
to health insuy-ange^ any more than a right to have a food-freezer contract or a ^ 
Ijest-ex terminator for one's home, this *wa^ treated as a commerci^il 'service offered 
to consumers, subject only to the anti-f^ud controls of general consumer protection/ 

During the past decade, however, using race as an overt criterion for health 
insurance has been forbidden by law. Offering different policy benefits to males • 
as opposed to fenijLes within the same occupational group or other classification 
have been attacked, before state regulatol'y commissions ^nd in the courts, and the 
health insurance industry has recently adopted a policy against; such disci-imination. 
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The same is trfie of homosexuality, where regulatory hearing^ in Pennsylvania prompted 
a health industry stateiiient that ^homosexuality per se would not be used as a basis 
^ for turning down an. applicant . Certain physical handicaps that once were used to 
decline* policy applications have been receiving similar reconsideration/ as a^ resul? 
of group pressures; for ex^ple, Florida recently enacted a statute forbidding under- 
writers' to refuse health policies to paraplegics^ solely because of that disability, ^ 

On the oth^r hand, health insurers do look at "life styles,'' and will reject 
persons whose health habits or style of living create special risks of health problems. 
These have- generally been accepted by regulatory authorities, as with writing spe'cial, 
low-cost policies rfor persons who do n$t smoke or drink alcoholic beverages, oi* use 
addictive drug&. , ' - " 

Society, clearly has a i:ight to define the criteria it will allow iijsur^rs to" 
use in writing insurance policies, in health or, any other insura!nce line. We should • 
recognize that what we are doing by such interventions is socializing certain irlsks, 
^ Since the companies cannot survive by losing money, all pollcy-holderb will have to * 
* pay the cost of not allowing €iie companies io exclude persons whose conditions* nay , 
in fact, lead to higher than, average costs of morbidity or di'Sability, or earlier' 
mortality. That one way society can prevent continued harm being done to persons 
-whose "objective" situation is the .product of past social and legal discrimination. 
Whether through industry self-regulatibn,« the state insurance regulatj^on process, 
, amendments; to. the Fair Credit Hepdrting A9t, or recommfend'ations for Congressional 
action by the Privacy^ Protection Study Commission, new standards of reip^TanBfe and 
propriety in the^ealth underwriting process should be a majcx^ effort, ^ < 

Sffectively^monitoring^these standards for compliance will involve scrutinizing 
the application forms of- health insurers, the inv^tigative or "inspection" reports ^ 
about applicants done by their* own underwriting departments or outside commercial 
reporting agencies, the reports of examining physicians where these are \^aed\ the 
examinations that are done of the individual's medical records und^r release 
^ •progedor.es, a&d the propriety of the uses made of data properly collected. An example 
of the latter problem is that street actress 'is 'a perfectly legitimate informational 
item to collect, an^" necessary for communication with* the applicant; but if it is 
^_used to^ reject^ applicants fromVsections of communities known to be predominantly 
^ 'black or Puerto Rican, that would be a racially-discriminatory policy to be prevented. 
When we turn to th^ claims process, we must start with the recogr^tion that 
identification of the individual, description of the service Vrovified, a diagnosis * 
of the conditi-on, and similar key information is. abso^Lutely essential* to determine 
coverage (or eligibility) under a-contract or program. Such data are, also needed 
^ to control fraudulent practices by practitioners and institutions, and ^ supply a 
database from which to determine 'future rates, coverages^ and programs,. As long as 
payment for American health care is based on a combination of the patient's funds, ' 
insurance coverages, and government reimbursement programs, *he claims review process 
must obtain such personally-identified information. In this sense, service payer^ 
' are /right In asserting' that they are central (and legitimate) participants in the 
American hfealth-service process, not interlopers, \ 

However,^ the legitimacy of the payer fimction has'been used, too often, as an 
Vexcuse for collecting knd retai/iing more-personal information for the claims process' 
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'than the function requires. We^foond that a lack of trust in the conf idenyiality 
rules and practices of claims payers (as a whole) was widespread among psychia^trists^ 
internal-medicine practitigners , medical record^^admini^rators ' and other professional 
groups, and 'was being increasingly voiced by Consumer and cp.vil liberties groups.*? 

The problems to be overcome are not in,- fairness , exclusively those of the ^ 
seryice payers. When hospital personnel fincj it easier and cheaper to ^s end out a 
photocopy of an entire medical record or hospital discharge, summary, rather than 
extr^tct^the specific information asked for by the payer, ^then the ham 'to confiden- 
tiality arises from ttie hospital** conduct, not the serviqe payer'19^. Or^^ when some 
psychiatrists use vague and uncommunicative terminology in a deliberate effojr-^.to get 
reimbursements for patients whose condition — if accurately described — , would not 
be covered by a' contract or program, and this prompts the icervice payer, -to «lsk for 
more details on which to base an accurate judgment, this 'leads tea .weakening erf 
,conf identiality fo^ -which those paycfiiatric practitioners must* share responsibility! 

The need, to clarify relevancy s'tandards for- claims review has prompit^d a number 
of recent actions. For example, we noted in*Part^Cne thkt the National Association 
of Blue Chi-eld Plans had adopted in September of 1975 a- set of "Guidfe^ne^ on Pre- 
serving confidentiality of Medical Records/'^ In the section on 
and Handling of Medical Information," the* Guidelines state: 



"3* .Plan employees should seek only/ those data necessary to " , 
adjudicate a claim, case or utilization patterns and profiles,'". 
The discussion of this says: "For example, if t^e^Bl&n needs only a discharge' summary 
or consultation ret)ort, it should not ask the hospital or physician for the entire 
record. To do so, not only creates storage problem^, but also places unnecessary' 
burdens on tho^e mechanisms i which are mbant to insure cdnf identiaLtaty.!* * 

Paralleling this guideline, leaders in the medical records profession have 
called on hospitals "to, maintain stricter equality con^ls oh information sent to 
insurance companies."^ Their proposals include hospitals requiring insurance com- 
panies to specify "why and what infoiT:^^tion is necessary" w^en they reque^st data 
beyond that clearly necessary to review 4 claim, and to return to the hospital the 
copy of a patient *s medical record within a specified, period of time, or destroy it 
after the claims review process is completed. 

Gome medi organizations have been negotiating with health insurers and their 
associations to work out better standards, , For exampla, the Union of Aznericgin 
Physicians and Afetria Life and 'Casualty Company agreed 'recently on j^ew proceffi^res 'to ' 
govern payment of health insurance , claims for persons covered at work by group pl^s. 
Aetna agreed to drop the questions <from its claims forA asking about factors respon- 
sible for ^he illness, the type of impairment ^n the^ patient *s family, and interper- 
sonal relations,* Only the medical director of the employer-company would be given 
the officia l diagnosis an .d^profmosis of the patient by the insurance firm^ All these 
records Would be destroyed after, one year. Diagnosis of patients wko were 'not vio- 
\ent and dangerous to others would 'not be made known to the employer or to the •union; 
they would only know •Ijhat the patient, was being reimbursed- for medical treatment.^ 

Model legislation is now under discussion, drafted by the American Haspital* 
Association and the American Medrcal Association, that \would affect the release of • , 
information by primary care prqviders to third parties^ This would obvio'usly affect 
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what service payers ^could lawfully- collect, and we will take thesp proposals up later 
in this chapter, when^we consider model legislation asr a whole. 

^^hen we turn to quality care reviews , the collection of detailed information 
about diagnosis, condition, treatment, i3utcome,^and the like is clearly relevant,,* 
and recording ^uch informatic^i for the care review process has become an important 
'pressure for more systematic data cx)llection in primary care facilities and service* 
payer organizations. ^ The key issue here in term^ of the principle of limited data 
collection is whether personal identifiers can be removed from the" records reviewed 
in this process. If this can be done, it would reduce substantially the threats 
that sensitive medical data about celebrities mj^ght leak out of the car^-review ■. 
organizations, or that information about political opponents, dis^dents, and sur- 
veillance tatgets -might be obtained by hi^jf^ivernment of/icials ti^^^h the cooper- 
tion of government care-reviey emloyees or b^Jp^penetration of the record sys'tem by ' 
teal^n. Whether this can be done will be a p^ticula^rl^ critical issue in securing 
ublic support^for any proposed national health instaranc^^lan, where the^roblem of 
federal medical record system on most citizens ^Jfaises special, post-Watergate sen- 
s^r-tivities . 

.There are^ several -available mechanisms to strip names and other imique identi- 
fiers from each record and substitute a special review number • This can b(e.,done by 
the facility holding the* original record, as with hospitals in the PAS system des- • 
cribed in Part One. If it is rjecessary in certain cases tq brin^ together records 
' on the same individual from several facilitie^or different- organizations, ^ special 
agency , private- or governmental, could be. given the job^of combining the records and 
forw^din|'i:he needed information with fenly a review\iQ4e riumber as the identifier. 
If atten1;2bn is paid to removing from tile record cvWier revealing information not 
really needed ¥br care review such a^ the , oe^Upation of a person as entertainer 
'Qr federal executive employee — there sWid be few reasonable fears^about identities 
- breaking through records even though names are not on them^. Should situations arise 
in which contact with the patient is necessary to resolve disputed facts or issues, 
those would be handled as exceptional cases, and this ought not to be cited as justi- 
fication for having identifiers ^o,n each record revieWd. * 
- ^iven these practical prpcedurp , we" s^uggesir that the burden of proof should be 

, ' on^ each quality-care review system ^to prove that it cannot operate under a system 
without unique identifiers; absent* such a showing," it should be the duty of care 
review organizations to devise a systki^at does not use or stjore identified 
* persona^ records.* , ♦ . 

S« Social uses of medical *an d health data a 

~ : 

When society should require the production of health data for, non-medical uses 
has come under serious re-examinatioh in the pift decade.^ We saW that i^iis was some-* 
^times a matter of rethinking the relevance of physical handicaps or-'emoti^n^l and 
^^^leilt^ status for decisions about employment, licensing, putlic housing,; etc. Some- 
times the'is$ue was how relevant past health conditions might be fqr making present^ 
decisions about people, especially where there had Ijeen a change in society's atti- 
tude toward a once-stigmatised condition (e.g., abortion), i S%i^ anoifcher issue has 
been how to deal with recording the health data of minors, with special problems of 
minor-parental relations and leakage from juvenile care into the, larger society. 

' <- . , \ • 
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The enployment area is a good one to illustrate *the application of the relevancy 
principle. We noted earlier in this, ^ port that lawsuits are now pending which chal- 
lenge the ri^ht of government and private employers to ask for general information 
*>out emotional and psychological conditions on^ employaffent applications. Opposition, 
to "intrusive med^Lcal questions, by employers" has been registered by the Privacy 

^Committee of the American Civil Liberties Union ,^ which has prepared a policy /ta^e- 

^ent opposing such practices^ for adoption by the ACLU National Board c^f Directors.'^ * 
Apart fron government licensing requirements tVmt include health Sests (airline 
pilots, persons working .in food ^establ:^hnents , ate), mo3t employers give job appli- 
cents health questionnaires to fill out. Some employers also require the completion 
of a ^lealth report by a physician,, either the patient's own or one supplied by the 
enployer. The typical health fo^^ms ask not only aboui standard diseases and health* 
^conditions but also histories of past conditions \|p. g. , bedwetting) and^about past 
and 'present eaotional problems, nervous disorders, and refated pscychologicafl. matters 
inclciding whether the individual is presently receiving psychological help. 

linr-loyerc justif:^' these inquiries in terns of securing employee^ who will be 

. able to perfora satisfactorily on the job, will be* likely to remain long enough to 
^:u::tir7 xae neavy expenditures for training; and proaoting enploye.'es , and to Iseep the 
eE:::loyer's grcu^^health preziiuns (which are basea on jitilization patterns) as low ^s * 
possible. In. a free labor aefrket, most employers would assert; selecting healthy em- 
ployees from the pools df job applicants is a 'legitimate exercise of employer choice, 
comparable to selecting the best educated, most exjexienced, and best performers on* 
aptitude tests. * , 

As with many ar%as once un^er coihplete employer prerogative, American society 
has imposed substantial limitations on employer selection policies during the past 
decade, in both governmental and private employment. If educational ^aquirements or 
tests prove to have the effect of screening out minprity racial applicants, for 
example, or reducing minority employment opportuni-^ies , the burden is placed on the 
employer to show that, the edLvcaiional requirements or tests are ^r^ev^t to the jobs 
involved, and tha\ they do not incorporate racjial biases. Similarly, even physical 
requirements'^ for jibs (sfeh as height. requirements ). cannot be used against minorities 

^or women unless^ they can be shown to be eiffsential to the performance of the employ-- 
ment, a standard that the Courts have used recently to stride down -many such physical 
conditions. In a^idition, federSuL legislation* in 1973 on the employment of physically 
and mentally handicapped persons recognizes an obligation by employers to provide 
special physical facilities that may be needed s'o that handicapped persons can carry 
out jobs, thereby wiping out the excuse that many employers traditionally^ used to 
.explain why they c'buld not 'hire persons in wheelchairs, usin^ Crutches, etq^"^^- 

< ^ In part, calls to reconsider heaith standards for employment have come from ^ 
practitioners of occupational medicirie, who regard many current practices of cor- ' 
5)orations as unwise. A study by two Veterans Administration doctors d6cumented * 
that industrial physicians would recommend 'against hiring persons with conditions 
such as angina, previous myocardial infarction, diabetes, hypertension, and previoup 
psychiatric illness, with the reasons cited including fear of company liability for 
further illness and increased insurance posts. The doctors concluded that such 
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restrictive policies ai^e denying work to "patients with mild illnesses, which may 
not increase their morbidity or mortality," and -thai the criteria used "have little 
relation to modern medical judgment." Furthermoy^, th'e^^authors voiced the concern 
that "with automation of hospital records, retrieval of ^medical data will become 
easier, and ^t may be impossible for an applicant conceal a past or present 
illness, however unimportant/'^ This increase in record-keeping trails Coincides 
with a trend toward discovering diseases "earlier in their course with the use of 
newer diagnostic techniqu^," making the problem qf employment for "patients who 
have various mild illnesses "even more wide&]^read, ' ' ^ ' 

3ame companies have altered their pre-employment health questionnaires to take 
account of citizen rights concerns. The Incorporation, for example, used to re- . 
quire applicants for employment to answer a q^stion about receiving prior treatment 
for a nervous disorder, mental problem, or emotional difficulty. A privacy review 
within IBi: during 1974-75 showed that this put applicants in the difficult position . 
of answering truthfully (and risking a turn-down) or "^ing about receiving profes- 
' sicnal help for emotional prcblerns/ (and starting their employment relationship with 
^the company cA a resentful and diishonest note).' The IBM review also disclosed that 
many psychiatrists ^ere cour.seiins their patients to answer "no,"., to such pre-employ- 
ment queries when the patient's condition did not indicate any inability to carry, 
cut the employment; that many middle class parents were fearful that ar35anging 
thVrapy^ for th§i?'^ children could lead to cu?*tailment of their future employment 
opportunities; and that there was rife medical or social evidence that persons who 
were receiving professionaljjelp for emotional problems were worse* employment risk^ 
thsm persons of similar edugational and social backgrounds who were not receiving 
such help. After weighing these problems against the .assumed benefits to be* gained 
bjr forcing self-declarations from appZipants , ' IBM dropped the^question from its ' 
pre-employment questionnaire -.in 1975.^ ' ' ' : • 

developing new standards for collecting health data in the hiring piaocess is an 
example of a priority area for action in Zone 5 activity. The ACLU Privacy* Committee 
sufggests that "the employer's legitimate interest in an employee's health extend's 
only to the employee's present ability satiaf actosily to pjerfor2i the job sought," 
and "this interest must be Satisfied by the'^least in^^sive- means available* "J ^ 
An employer who wishes to verify that ability should^Jy for a medical ^examination, * 
with the employer "entitled only to the physician's certification of the applicanli^'s 
ability or inability properly to perform the job as describ\d to the applicant and 
thg examining physician." Whether done by the applicant ^,s oVn physician or a company 
physician, all medical information obtained, by such an examination "shall be privi- 
leged and confidential" and not revealed to the Miployer. 

Thi^&^ecommended policy is one that also cfRcides with IBM\iompany practice. 
While less than 2% of IBM applicants are not tired for medical reasons. Dr. John Duffy, 
IBM's medical directpr, notes that 5?^ of its employees fall within UJL.a^. Bureau of 
Labor standards of handicapped workers^ and approximately^ 20^ of"lCBl^ employees are 
subject to medical restrictions (e.g., controlled diabetic). ,When applicants are 
given pre-employment physicals by IBM physicians or outside consultants, the results 
are kept confidential, and IBM managers are not told the specific health reasons if 
work restrictions 'are set by the company medical department for new or ^existing 
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employees. An employee's health condition is never included in IBM?s personnel 
data system J \ 3, ^ ' ' ' - 

Our discussion of collegting health data on 30b applicants illustrates (ai we 
have noted before in this report) that the relevancy and propriety issues foi- data 

^systems usually raise deeper questions of social policy,* |here is -no necessity , that 
the questions ^be raised in the context of records and data sys^tems, rattier thai more 
directly. But rhe reality is that this is often the way that affected ^groups jind 

^public-interest organizations can bring the problem to public attention, Sinc<5 the 
building of new data systems brings these policies up for organizational examination 
in terms of data collection costs and efficiencies, this is the ideal opportunity 
for society to insure that proper citiien. rights policies are instituted, 

3- Notifying Individuals of Data Policies When Their Information Is Sought ' 
Principle * . , ' ' 1 ^ 

Vihen an individual is asked to supply p^rsonal^ information to be included in a 
health. data system, he or she should be given a clearly-written account of how that 
information will be used by the coliecting organization, and what procedures for 
. obtaining consent will' be follow^ before any additional uses will be ipade within 
^the collecting organizatiorl or/identified information is supplied to other parties, 
Discussion 

Following the contract or mutuality principle, the -Federal Privacy Act and its 
state counterparts require that individuals \e -informed, at the time that their in-, 
formation is sought, of how their 'data will be used and what the^ organization's rules 
for data sharing' are. . Simple and equitable as this sounds, it has not been the prac- 
tice ^ong many health organizations, generally on the asaumptions that people don't 
^really care and that it would only stir up unnecessary anxieties/ Though experience 
to d^te needs to be systematically canvassed by the Privacy Commission and oth^r 
bodies, the impressiori drawn by our project from contacts witfi various federal health 
.agenciesUs ^hat such notification has been going fairly well^ Agei^cies have included 
notices on the^r data collection forms, have displayed posters in their offices, and 
have obtai2led signed acknowledgments from th4 individual's indicating that they, have 
^een informed of the policies and give ^ their information after betng so informed. 



^ The- one complaint" that 'itfe have heard involves fears that an organization might 
/ been ^^escri bed and assentedl to at the time of original .collection. An example cited 



want to use personal infomation for an important purpose later that j^ould n9t have 

/ 
/ 



to us was that data relating to the effects on. patients of using a particular drug 
many.^years earlier might not "be available for follow-up research, as when there is 
some reason to believe th^t a birth-control drug used ten or twenty years earlier^ 
might now be producing cancer in those who took it. To ask the patients for consent • 
to use their later data in the hands of the hospital might alarm them unnecessarily, 
before the possible effects have be^n confirmed. * ... 

Rather th^ abandon the prihc^iple of describing present- and future uses at the^ 
time of collection, we think that expl^j^tions developed by ^rious kinds of health 
facilities and organizations. should be drawn up with such postible contingencies in 
mind, It^^oes not seem beyond the ingenuity of experts in medicine, law, and admin- 
istration to encompass these in a notice. If some unforeseen development pccurs ^ 
later, either subsequent consent could be obtained or the additional use might be 
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authorized by an independent review body set up to supervise health data systems in 
a particular field and insure protection of citizen rights. Whatever technique may 
be developed, the basic point is that citation of hypothetical future possibilities " 
should not be allowed to overcome the requirement of notice, 

4. Information Release Forms SKould Be For Specific and Limited Purposes 
Principle ' * ^ 

Because the trend in automated health data systems is to record akd retain 
personal information more fully and systematically, general release forms do not 
, meet proper standards "of citizen rights. The forms used to release personal infor- 
mation from a health data system should be for a specific purpose, 'should describe 
the information to be released, and should be limited in the time period for which 
the release applies. Adequate procedures must be followed to obtain the individual's 
voluntary and informed consent to any release. Provision of entire medical records , 
under re^eas^ procedures should be permitted oi^-Axipon use of a special release for^ 
reviewed by a special officer of the record-keeping organization. Organizations 
seeking release of information must file with the record custodisin a form Sjidicating 
how they would^use the data, specifying that >'t will not be released^ to other parties 
without the' individual's consent, and indicating what the retention or destruction 
policies are for -the information so obtained. * ^ . ' • 

Discussion ^ >' . . - 

The general relea^ in the health field^ings ,to*mlnd the general warrants to 
search and seize used by Britisl^ officials in our colonial era, against* which the 
Folding Fathers fought so bitterly and which they forbade by the Fourth Amendment 
t6 the U.S. Consti-tution. Among the vices' of the general warrant jwere that \t au- 
thorized anyone holding it to engage in a search; did not indicate the purpose and 
thereby define the proper scope of^ the search; and did not specifically describe the 
things to be searched for and seized if found. While the^ law enforcement and health- ^ 
care settings are very different , the analogies in civil liberties theory are, alas, 
all too. close. V - . ^ . 

- Individuals ire being asked today to sign releases that allow the Qustodian of. 
the indivi<iual«s medical record to disseminate its contents however, and to whomever, ^ 
the custodian feels necessary, or tlM'" allow someone who is offering a benefit or 
service to the individual to examine^ "any and all" medical records in any doctor's . i 

•office or health institution to which the inqUii*ing party shows up^ armed with the f 
general release. The absence of informed consent in such situations is proved by 
th6 fact that individuals in most health institutions do not know" (and are<- not told) 
what personal, family, social, and medical information is in the records that will 
be opened for" inspection. * Even if thjey do know generally what is in their records,' 
they are not told vipxih segments of this the insurei*', licensing body, employer, 
welfare departikent, 'etc. will hav^ access to. They are also not told what will. Jiappen 
to their information* after the party to whom it is ^released .has* made ^ts decision - 
ivhetker it will be destroyed,, passed on to industry data p>ools, stored permanently 
by jKe thii^d party, etcj. , 

^ Such practices, bad as they were in the manual- records era, cannot be permitted ^» 
to persist in the era of large-scale health data systems, with increasingly compre- * 

.hensive records being gehei^^d and preserve^ in primary health car^ facilities and 



in special medical files. One can' understand the motivations of the health providers 
in seeking the- broadest possible release to avoid legal liability for releasing in- 
foraation without permission, and by the third-party inquirers in seeking access to 
anything that might ^rove to be relevant when they go to make their determination 
in a specific inquiry. But allowing such motivations to justify the use of general, 
all-purpose releases is to allow the inferior bargaining position, fears, and tempo- 
rally dependency of persons receiving health care to be legally institutionalized, 
just as the law used 1fo accept similar disadvantages for consumers, debtors, and other 
groups in unequal \bargaining status to large institutions. Just as the latter abuses 
have recently ^been overturned % legislation and court rulings, we ought to overturn 
abuse of power in the^andling of information release?. 

There are health centers and hospitals which take exemplary positions in this 
matter:. We saw in the profile how the Martin Luther King Jr. Health Center r.e quired * 
^tient consent to the release of inform'ation. Here is the recommended policy for 
neighborhood health centers, as presented in an excellent guidebook on ( confiden- 
tiality published under C20 auspices i|j^197t:^^ ^ 

* Release of Information ^ith Informed Consent 

The health center should not divulge confidents! patient infor- 
mation contained in patient records without obtaimng a signed release 
^ from the patient, unless, (1) there are statutes to the contrary, or" 

^(-) the;e is*a senous emergency requiring release without consent. Does ^ 
"this mean that the health center must release patient information 
whenever it receives a signed patient authonzation? The answer 
depends largely on the statutor/and ca^e law of the state In general, 
jy;onsent is not considered valid unless it is infomied consent, i.e., the 
^ ~ patient fully understands^ what he is consenting to. Even in states where 

the law requires rclea^ when patients have signed consent^forms, health 
institutions must take precautions to protect the, parent. The medical 
record librarian should take the five steps described in detail below 

> Require the patient's signed consent. 

# I * The patient may write his own letter of consent or sign a standard 

form, such as a health insurance policy^form If the patient writes hi^ 
own "consent statement, he should state specifically to whom^ the 
information is to be released and exactly what information is to be 
jeleased, and he should sign and date the request. The librarian should 
check th^ patient's signature against a previou^y obtairied signature^ » ^ 

and note the date to be sure that the request is current; It is advisable . , 

"* to set a maximum length of time^- such as 90 day^> after which the 

request is no longer cons/deretj current and will nOt be honored. If 
there is reason to beheve that the authorization is nqt genuine, or if it is 
\ ^ not current, the medical record librarian should withhold the informa- . ' 

* ' tion until she has received a valid, current authorization from the 

patient. One wj^ of determining whether thr request is genuine is to 
contact the patienU)y phone. 

Patient consent lor release of information should not extend 
beyond a specific illness or its subsequent treatment, tt an autiioriza- 
tion carries a date which is prior to the <Jatc of the requested infomw 
tion, the medical record librarian should determine if the tuthorization 
apphes to the specific iUncss for which information was requested. If ' 
the authorization pertains to a diffefent illness or treatment, a new 
\ consent form should be obtained. Each health center should hay^-iU 

I standard consent fofmsr-rcviewed by an attom'ey to make certain that 

the forms adequately protect the patient and the institution. 
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fistabiish that the patient uruUntands what tnformation 
is being released and to whom it is being released. 

^ This^is_iiifip<»%f to emigre informed consent. It will not be 
imible to check witff the patient in every cas^," but it h importaAf to 
, contact the patient, if there is reason to doubt that his consent is truly 
intormcd. ' ^ ; 

Because of the pressure that is often excrt^ on people to sign 
printed forms, center staff members may wish to educate all p'atients 
about the consequences of signing various kinds of forms. 

Send out only that information from the t 
fxxticnt 's record which is specifically requested. 

For example, the health 'center should withhold psychiatric aftd 
social information unless it is spedficaUy requested. If an insurance 
company or the SUte Industrial Accident Cqmmission seeks informa- 
' tion regarding a partiAlar accident, the health center shpuld withhold 
information recorded before the date of the accident unless the infor- 
mation is included within the scope of both the request and patient's 
consent. 

Inform the patient's physician or the appropriate 
team member that information is being released. 

If the record iontams particularly sensitive data, consult with the 
physician before releasing any information. 

Be reasonably certain that the institution 

or individual to whom the information is being s 

released will keep it confidential, * 

It may be impossible to receive a guarantee of continued confi- 
dentiality in every case, but the. health center may >¥ish to consider 
requiring such a guarantee, in wnting, from any institution or individual * 
that receives a great deal of paUent information and from any institu- 
tion or individual whose willingness or ability to guard the confiden- 
tiality of patient information is in question. t 

Health care^^viders from'different agencies may^ legiUmately 
communicate verbally about a paUent Without written' consent when ^ 
they are cooperating in ihe care of the paUent. For example, ^ when ^ ^ 
elderiy person js being cared for by a pubUc health nurse ftom another 
agency as weU ^ by a family health worker from a neighborhood health 
ceoje^vm^ny informal communications between the providers are^le'giii- 
mate and necessary and do not require written consent. However, 
health center staff members should^ make certain that -they have the 
patient's understanding^d verbal consent, in order to, avoid invading • 
his privacy or making communications that the patient' himself would 
•notTOjfke. i ^ ' 
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While this illustrates the kind of sensitive policy ,that some neighborhood.'^*.-: 
health centers are already using, largely for manual record systems, we'^ithihk/vl'^ ^ 
that more detailed and protective" policies can and should- be us^d in health data' { 
systems. These involve specification to the individual in written fom of tile ' ^ 
organization or persons who will obtain the data, the purpose for which the infoi^ 
mation is sought, the specific data that would be supplied, what will be done with 
it once the stated purpose Us completed / and what promises *the party obtaining .tke 
data makes as to its safe and secure treatment. Such releases should only be for 



a limited time period (such as 50 or 60' daj^fe). Th^ cionseqa^ices to^ the individual '- 

that alight occur if the information is supplied — or not supplied — should. be^ 

clearly explained, so that he or she ^could, dfecide whether to reveal or _ Withhold the^ » 

"information, . (The Georgia mental health cenijer study we discussed, earlier in this 

report indicated that many persons receiving medfbai services would^not consent "to ^ ' 

disclosure of their records to state health auxhoriti^^s if they could be assured thati 

this would not jeopardize. their continuing to deceive medical assistance.: ^ Release r 

forms should be revocable by the individual witkin^a ^ecified timef and .this right 

should be fully explained, inclfiding, of coutse,\ the ,^tftentially »harin^u^ <;onsequences 

to the individual of such revocation, ^ 

One interesting proposal made, by JDr, Simon A^ster, Virginia psjrflthiatrist and 

expert on citizen rights issues in health care, id tb'giv^ the' patieat in any health 

care setting an advance copy of the information thit is to be released, , -^Phe statutory 

laaguage he proposed would be as follows^ \ - - ^ - 

"No Information identifiable to the patieAl shajLl be' released by ^ 
the hospital, facility, agency or physician'-witnout thfe' patient's ex- ^- 
press permission, except ( 1 ) as may be ordered' i^y a P.6urt of Record, ^ ' ♦ 
in which case,, the patient muSt be given prior notice^ of » su<I:h ord^r. 
and may contest it in the customary manner, or (2) where the patient 
has a communicable disease, the reporting of whi^ is required by0.aw^ 
in which ca6e the patient must, be informed that the report is bein^ y 
made," - \ ^ 



•*The patient may request, and will be provided, with copies of 
any o^her* information the hospital, facility, agency or physician 
proposes to release to any other parties authorized W the patient *^ 
to receive- it. The patient may rescind his authorization to release 
the information within two wefeks after receiving his copy. No hospi- 
tal, facility, agency or physician shall release any information about 
a patient on the basis of a ^blanket authorization witriotrt first o'^tain- 
ing specific authorization from' the patient,. At the time the patient 
is requested to authorize the^release o^f information, he shall be in-, 
formed of his right to receive a copy of the information ih advance, , 
and of his- right to rescind the authorization within, the' prescribed 
period if he wishes." ^ 



An important aspect of Dr. Auster*s proposal i^s that it \brings the elemeiit 
of patient notification to bear even when statutory law may rteqiiire the reporting 
of communicable disease (and the patient cann^ prevent 'the reporting) , ^In 

• fact, as we saw ih Part One^ c^urrent statutes require the- reporting of many ^ 
more conditions than communicable disease, such as gunshot wounds or child- 

. abuse injuries* Presumably, legislatures coftsic^ring new medical confidentiality 
codes would decide which existing reporting duties should be retained, and 
could apply the patient notification principle to those area$ as yell, , 

^ - , \ 
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, 5. Increasing 'Pa-tyitat Acc^sa. Rights. Vtb"^Their%n' Medical Information 

PrificLple , » ' *' v' • ^' ' " ' * 

Individuals 'should hfve a, general right .to ■information about their hea^lth 
, condition, treatment, and prognosis, as a matter^f fulfilling the profegsionaf's 
- fiduciary djjty and protecting the patient's ultimate primacy in choosing hisAer own 
, healtfuiestifiy.. '|ri health data systems', an individual should'^have an absolute right 
. ^ to Jhspect^any' reSVded data about him or her that is used to make judgments about 
•'• ^ligibili^Sr- for health prograins and coverages, claims payment, or other aspects , of 
servlq,e- admin i^ltrat ion. The same absolute right of access should be provided when 
>health^ data are disseminated to determine rights, benefits, or opportunities outside 
primary care settings, as in insurance, employment, licensing, education, welfare, 
^' etc._ A proceduffe sh(^ld be provided for explaining medical terminology where this 
^yis>.necessary, and f or Ji^lowing the individual to challenge the accuracy or 

'incompleteness- of the recorded data. ' ' . 

W>iere that part of the medical record is involved in which the health ' 
professional's working' notes- or pther speculative, informal recordings are present', ' 
^ or where they are sensitive judgments about the i^atienfs emot3,onal condition that 
-.might unduly upset -the patient to see, and these materials are used solely within 
. he .primary-care' -facility, procedure shogld be "afforded that giv^s the physician 

. an opportunity- to explain to. the patient^ wKy access would not be desirable or -to 
. suggest disclosure to another ph^rsician of . the pa1*ent'.s choic4, but if the patient 
is not persuaded by these counsels, a right of acces^S should be provided to patients 
m either chronic and acute care, where' psychiatric dare is involved, disclosure ' 
vof the record directly to the patient over the advice of the psychiatrist would 
require an order i^rom a civil court. ^ ^ -■• - 

Diicltssion ■ "- ^ . • " 

, -Whether an individual should have a pight of access 't Ais/her inedical record ' 

.^".^'health dat^ system raises the most'complex and controversial issue^'f this study. 

. . We found thoughtful and ethical positions on^ both main sid^s of the debate, -and 

. therea^e -vexing complications in all the ref orm.'proposals ^that have bee'n advocated. Lor 
these reasons, our discussion of access will be more extensive than with any other . 
principle presented; and we will first summarize ' the existih'g state of policy ^ 

• conflict and law to have this at hand for our analysis, -'. ; 

Underlying the basic access debate are two competing models ^of hL information ' ' 
should'be controlle^n the doctor-patient relationship.^ The traditional modei. • ■ " 
still dominant in'the^dical profession and among health administrators, is the 

_ "doctor's judgment" approach. It assumes that the expert, ethlcdlly^und physician ' 
ought to decide what inf/rmation is made available to the patient, based on the 
professional's judgmen/of what will be in th^ patlentis best Interest. This model' 
reject^s any. notion of a patient's right to "full" information f^;,several reasons. ^ • 
complete discl'osure might create needless apxiety or upse^ a patient unduly, telling ' 
only part of -the truth, or withholding information temporarily, „,ay be'good medicine ' 
in.a particular situation, |s.pi-cially where psychosomatic aspects are involved, 

, patients would not be helped" if they were to be told the speculative, and tentative , 
hypotheses that physicians were considering at a given momeAt, and, especially in . 
psychiatry, the patient may be so emotionally inbapable of handling tr^hful 
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information that its disclosure yould be positively harmful., A good doctor, it is 
^ said, should disclose every bit of information that will advance good care, but this 
must ultimately be the doctor's decision, , and one not subject to delegation to any 
o^her authority. 

The more recent model of information control regts on a "consumer" theory of 
healtJ\ care. It sees the physician as an agent of the patient, hired to exercise 
his/her professional skills and judgment but' also bountj/by a fiduciary duty to make 
, full disclosure to the patient if and when this is demanded*. Such ^ right to full 
information is seen as important for the following reasons;, it is essential to the ^ 
patient in making inf ormed^decisions 'about the* riskB and benefits of proposed . 
treatments and operations; it is essential if the ^patient is to know whether to 
__author^ze release of hisAer medical information, 'to third parties; it fqsters patient 

participation \Ti and taking responsibility for.^is/he^ own he"alth care; it would 
^ assist patients in making consumer judgments^ about the acceptability of care being 
provide^ by a*given docto;: or hospital, corripared to other available alternatives; 
l^^d that whire some patients may be' so ejnotionally distraught that they cannot handle 
full information, those adult patients who ask for full disclosure of their jjondition 
^»and prospects shjbuld not be denied it, -including those situations of terminal illness 
where a particular patient wants to be able to decide' how to use the remaining perioti 
of life. ^ ^ ' , , ^' . . - 

At present, American case law does not clearly resolve the conflict between 
these two theories, and each can point tb some decisions advancing its position. In 
support of .the consumer notiiDh, the courts have held that a -doctor must inform the 
patient :of all the risks and ^potential outcomes of * any dangerous procedure, and t^ 
withhold anything that mighVbe relevant to thfe patient's decision constitCites a 
failure of duty. On the othep hand, in ordinary care, |the courts have upheld the 
doctor V right tp deOide What information to disclose ^6 xfie patient &nd his family,, 
as a, matter, of professiorial judgment of the patient's best interests. 

Wh^n the disclosure Issue , shifts to the question of access to medical records , 
several Additional arguments aire added to the basic positions held by each model.- 
In behalf .of the consumer position, it is argued ^that't medical records today,* 
especially in group Practices and hospitals, are compiled , by a variety of health 
professionals *and ufeed by Various persons giving carei, , making it essential that a 
\. pati^t who feels yfchat mistaken 'Or erroneous data h^s. gotten into the record should 
'be able to see sma correct it before care decisions are made in reliance onjyrong 
data; examining j/hat is ffcorded is the only way oail^nts .can decide intelli^ntly 
whether to release some* or all of it for service payment or social-use purposes; 
providing accesfe would lessen the heed, of patientSNj^o file malpractice syits just^o 
•see what was iA the record; and showing patients their records on k regular basis 
would improve/patient confidence in care and enhance patient cooperation in treatmerft. 
If the recordfs today are. not wrijtten in language that .would be intelligible -^o • 
^ patients, tl^ consumer position contends , that explanations should , either be added to 
the record made to the patient orally by, health professior^ls , * * 

The dcfctor's judgment model, in opposing a right'of access t<5 recprds, responds . 
alon^ the following lines. Medical records are generally writttn in technical and 
jargonistic terms ths^t communicate to fellow professionals but that patients wouljl 
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^ not understand, and having to explain* these constantly to patients would be an. 
unnecessarily time-copsuming and expensive, procedure j having to write notes and 
observations constantly'' in a way that-w^ld be diplomatic when read by the patient ,v/ 
would impair the directness and clarity of present^cordr-keepingi ■ providing ac^^ess 
would inhibit doctors from putting down the speculative* and hypothetical -comments 
they 'now do, to help both themselves and other professionals who may later consult 
the record, arid would. lead to-highly defensive re col:^ -keeping practices j arid all the 
above pressures would make medical records much les^valuable in the future for 
service payment, medical research, care-review, and'^ilar uses. 

Jp^^^^^ with the right to information » existing law>9|i access to records can only be 
called inconclusive. *In the great majority of states,^ there is no legislative or 
judicially-declared right of general access' by patients to their own records when 
these are in the doctor's office or hospital, though the law recognizes the patient's 
^ right to have the records sent to a new doctor or Jiospital, or to have the physiciati 
furnish re/<or3 data for care payment purposes ♦ While oj^y a few states have enacted 
a generaljright of access statute, any patient who files a malpractice action is able 
to secu;^ the entire medical record fCr the purposes of the litigation. Federal 
agpH?ies providing health-care, such as the Indian Health Service or Veterans' 
Aclninistration hospitals, are npw governed by, the Federal Privacy Act of 197^, *which 
s^s a general right of access by individuals to their federal records, with no 
exemption in the statute for medical records. However, regulations issued by^federal 
health-care agencies have specified that, if the federal physician ,feels it is. called 
for, disclosure of the patient's record can be I'iraited to an ^outside physician 
, selected by the patient, who would then decide what to disclose to the individual. 
While the two' basic models ar.e usually advocated for every type of health 
setting, some commentators suggest tHat society's response might well apply different 
rules' depending on wh^t kind of ^ care is involved. For example,, the management of 
chronic illness and rehabilitative medicine in clinics and doctor's off ices,, with a" 
focus on continuing-care' relationships over substantial periods of time and tiie need 
for patients to cooperate actively in health r&giraens, has been seen as the most 
favorable setting for a patient right of access. On the other hand, psychiatric 
care has baen described as the .least favorable; sinc^it is- assumed that so many 
patients in private or institutJLonal care are. likely to be harmed by a .policy of 
automatic disclosure. This leaves acute care— the typical Hdspital situation~a^ 
middle ground. 'a - 

Having summarized the arguments for and against access rights, one last point - 
of background is useful. O^^the whole, automation of patient histories ,a;id medical- 
record applications^ both accentuates the prdblegfn for both sides and. offers some -% 
interesting possibilities for working out practical solutions. * - '♦^^ 

Computerization accentuates •because( as w^ noted) it leads to richer and more 
complete patient records. Thi^ makes^ patients more concerned about what is now 
captured in their records and disseminated ef f icie^^itly .beyond 'the primary care 
setting, and makes doctors more worried- about having their detailed progress note^T^ 
formal diagnoses, and observations oh emotional and social aspects printed out for 
patients to take away ,^ and of ten' to show to their lawyers and friends.- At the same 
time, compared to the handling of manual or microfilmed records, the computer makes 
it much easier to^print only selective portions of a record, under rules o^ 
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authorization, and to suppress securely all pairts of a record that aire not to 'be 
displayed or printed to a given inquirer— patient , insurance company, researcher, 
policeman, etc, ' ' ' 

' ' Recogpizina?' the persuasive aspects in each baaic view of disclosure and good. « 
he.alth care* policy choices still must be made. The ones we recommend moVe toward 
increasing patient rights of access. Two central considerations he\^ us ta reach 
this judgment. First of all, for most Americans today, health caire is simply no 
longer the one-on-one, family-physicism situatr^)n in* a Dr. Kildare and Maircus Welby * 
type of personal medicine, where the , individual 's personal and emotional li!fe, job 
problems, and family, relations aire intimately known, over' long periods of time, by 
a single physician or small group practice. For .jthe majority of Americans, care by ' 
a succession of doctors and nursed in group practices, clinics*, and hospitals is the 
rule. Given 'the (nobility 'of Americans for schooling, occupation, &id residence, 
chsinges in such physicians and institutions are frequent. And even those patients 
who h.ave access to one regulair, general practitioner will^be treated, by a series of 
specialists and institutions for pair ticular problems. ^ In this setting, it makes no 
sense to install a national legal rule as to patient access that is geared to a 
^Treatment situation of sustained personal relationships that covers only a small 
minority of the patient popu'lat'ioA. ... 

Secondly, we are entering a period ot change in the format and content of 
4tijfc|ical records, spurred not orQy by dissatisfaction within^ the medical profession 
that hds prom^ed problem-orie^^€J^ record reforms, but also the ^tremendous pressures 
to redesign re*cords J..n^Pd^r to meet increasingly strict payment and care-review , * 
"requirements. This condition of change being the case— and with the information- 
handling capabilities oX the computer to draw upon for innovative Solutions- 
American society ought not to allow the present chiuracter of medical records to* 
control the decision as to what would be .the best .access policy for the future, 
especially fSr .automated health data systems. 

For these reasons, we suggest^ that health data systems should move toward a 
two-tier or "dual" system of medical records. The first part, which would come 
to be" considered the official record, would consiat of all personal data about the 
patient I social and family history j complaints, test^^and examination results j 
diagnosps recorded; treatment summaries, drug regimens, etc.i payment Information i 
.amd any other sets, of data that were to be recorded as off icial. The patient .would 
have a full right of access to this part of* the record, with a procedure to explain 
medical terminology or 'the implications ^f diagnoses* 

The second ^arx of the record would consi»t of any especially sensitive judgments 
about a patient*s emotional or psychological condition or speculative and tentative 
hypotheses tHat a health professional wanted preserved for h^sAer own use, or that 
of others sharing in direct, primary care/ Such materials would not be available ^ 
for any other uses beyond primary case. It would be reachable through subpoena by 
the patient in a malpractice case, just as such physic ian*s notes sire now. Obviously, 
then as now, anything a physician did not think it safe or wise to write down* would 
not become part of any record, a prospect that would at least prevent the , circulation 
of such data to third parties • 



The idea of dual record-keeping has been endorsed- recently by -an interestingly 
.varied set of commentators, such as the American Society of, Internal Medicine, the 
American Civil Liberties Union, and the IBM Medic^il Department,^^ The concept rests 
on preserving the confidentiality of especially sensiljive professional commentary 
-within primary care* while recognizing that the patient's interests in protecting 

• his/her rights in service piayment and sqcial usjes of medical data must be inspired. 

We recommend that different procedures for patient access to the second part of 
the dual record be followed for chronic and acute caire on the one hand, and 
psychiatric care on the other hand. For chronic and acute care, those physicians or 
institutions .that wish to do sp ought to be encouraged to experiment witrf regularly 
giving patients copies of their entire problem-oriented record^ ^as is being done with 
considerable bene^'it in several hospitals already Where thi^ijs not the policy 
followed voluntarily, a three step process should,' be required t 

\ 1. The hea]^. professional supervising the patient should have an opportunity 
to discuss with the patient directly why the professional feels access to the second 
part of the record would b6 medically or psycho logid^ly unwise, 

2, If the patient is not persuacled, ,the health pifofessional should be able to 
recommend- th^Lt disclosure be made 1^5 anotl^ewphysiciein'of the patient's choice, who 

• could then decide wha^t to reveal to the patient, / .. A 

3. If the patient rejects both these options, the patient should hive the right 
to see the record. Essentially this is on the ^ theory that there^ has already been, a 
collapse of trusr-in thp doctor-patient relationship and it woi^ld not be good 
medicin6 or in the patient's best interest to continue to refuse access at that 

■point. ' s - - ' 

Psychiatric care raises special problems,^ since many patients in therapy — though 
by no means all— may be so emotionally disturbed \hat,they could not -"handle" ^uch^- 
information from the seQond part of a record as diagnostic terras, observations on 
their personal histories, etc. Where there is individual psychiatric care in a 
one-to-one relationship, non-institutionalized, we re;2ommend the pame first two 
steps described above but a different third step. If the patient still wishes to 
have aQcess to the record after 'the psycHiiatrigt .attempts to dissuade tiimAer, the 

^ record would be provided unless the psychiatrist felt withholding it would b^ so 
important to the patient's well-being that the psychiatrist is willing to end the 
therapist- paAent relationship. If such is tJ^efs^case, th^ record could be withheld 
unless the individual applied to a civil court to have the record disclosed,^ The 

/ court would hear in chaml>ers the arguments of the -health professional and the patient 
and then decide whether direct disclosure was to be ordered. ' ^ 

' Where ind^ividuals. are institutionalized, the need to protect their rights \^ 
against abuse, especially in stkte mental facilities that may be providing inadequate^ 
care, makes a third-st&p. court proceeding brought by the individual or, hisAer legal 
guardian the desirable procedure. This is ess^nftally.j/hat the court did 'in gr;anting 
parents of retarded children at WillowbrooK in J<6W York a. continuing right of access 
to the medical recorder-^s part of a suit broug\^t against the institution ^ to insure 
adequate care. ' > \ ' * ' 
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As we suggested earlier in this discussion, the computer makes it quite feasible 
to store all the data about a patient in one file that has different accass codes to 
control display and print-out of two diffefrent segments or even to store the 
sensitive seconS part of -a medical record on a minicomputer apart from the main 
patient files. Audit trails can be established to document who uses the "internal** 
segment, and a general inspection and testing- of the- dual r'ecorCl system would be made 
periodically by the reviewing authority we- have already proposed , 

There is little doubt in our minds that the suggestion for a dual record system 
qpd giving patients access^ rights will be vigorously rejected by many medical 
practitioners 'and health administrators today. It may be that it will take years of 
experience with Federal Privacy Act access procedures, with further voluntary projects 
such as those being conducted by, Dr, Lawrence Weed, Dr. Arnold 'Golodeta, and.othersi" 
^^^^^^rporate progrjim^^such as thatjsf IBM before a majority of the medical 
l^^^sl?^ would be willing to accept these ideas with enthusiasm. Some persons such 
as Dr. Gq-lodetz suggest waiting out that period*, and counting on example and 
advocacy^'to persuade. But this assumes^ that we have a good deal of lead time, ari^ 
assumption that ^ust be examined in terms of when a national health insurance plan 
might be enacte(i, major expansions 'of health data systems might go forward in 
hospitals, and major regional data systems might be developed. When sych major steps * 
are taken, we Siiggest that the line has been 'crossed at^ which the in:^ervention of 
law ought to take place, ^at I6ast for the records in those health data systems, . • 
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6. The Duty to Insure Appropriate Accuracy ■ > . 

Principle . . " 

The managers and staff of a health data system mu'st take steps to see that the 
personal data they store are as accurate, timely, and complete as the uses to be 
made of them require, not only to assure the individual's proper health care but ' 
also to protect the social opportunities and benefits of individuals that may be 
^ determined through use of such data. Pai^ipation of the individual in review of 
his/her records before ^-elease to third parties , and &ffordihg individuals a general 
right of access^o t|eir. records , repf&enf helpful ways to improve accuracy in each 
data systems. ' * ' , . ^ 

Discussion . / - , 

Throughout our projefct, in studying the literature ^d .making our site- visits, 
we saw that Errors of personal information, faulty recording of .'t«st results and" c 
diagnoses, and failure to complete necessary record items were- persis'tent problems 
of record-keeping in hospitals and doctors' offices. When records are automated, 
their use by many members of a health team, or their cirVulatiin throughout a 
multi-unit fa'cility or regional health organization, or reliance on them for " . 

ptoducing payment , claims , and sociSl-use data all make it important to assure • 
the ac'curacy of individual records. . . . 

li'hen an automated system is properly designed and administered, it can incregsi - 
traditional accuracy levels. For example, we saw automated systems in which failure - 
by health professionals to supply the information called for itsj>eports woi^Ld produce 
"tickler" notices to the professionals that such omissions had occurred, as well as. 
notices to_data processing staff or administrators to talce follow-up action if the ' '"^ 
data were not furnished within a certain time. Orientation and training- sessions 
also helped increase the cbmmitment to supply required data. Tests for the internal 
consistency of datain-a record can be written into software programs, thereby - 
catching som,e mistal^s that would have gone unnoticed in a file of jiaper sheets/ " 
We al.so saw tha\ accuracy was improved when patients undergoing automated 
^multi-phasic testing in hospitals or corporate screening programs were given a * 
printout of theif persotal data, histories, and "previous test results, and would 
correct inapcuracies that they noticed, The same improvement in .record accuracy 
and completenesb took plabe with the use of automated problem-oriented records given 
to patients in Dr. Weed's center, and with the admission pl^^i and discharge' summary 
provided to patients in.^the Vermont rehabilitation center project described by 
. Dr. (Jolodetz. Greater use of such patient reviews in prima:^ care or of subscriber 
reviews, in hfelth insurance would certainly lead to a higher l.evel of accuracy in 
records. * ' ) 

- • « 

Whether or not patient access is afforded, managers "of health data systems 
must take effective steps to see that_record3 are accurate, timely,' and complpt 
What these standards mean in a given data system will ^h&vq to depend on how tke 
• records are being used.' For primary care , • Jel^ance on the reSult of an outdated 
lab te^t instead of doing a new one' before making a p^dical decision 6f going ahe\d 
with a drug -dosage or operation would obviously be ■ unacceptable. Similarly, accept- 
ing a recorded diagJiosis tha^ came from a source 'or a situation that was less than" 
completely reliable (ajschool nurse's comment that a child's fi-Hooked like 
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epilepsy) would be an equally poor 'reliance) oh "the record*" 

The- basic point is that the more comprehensive a health data system, and the 
more its records are relied on, the greater the attention that must be paid to 
accuracy, with a resulting commitment of personnel resources and systems controls. 

The Duty to Apply Appropriate Data Security Measures . 

Principle 

^ Because of the sensitivity of the personal information stored in a health data 
- system, security measures must be taken to >imit access by personnel wi.thin the 
organization to those with a need t<^see particular information items in a record, 
^0 monitor da1^a uses in order to detei^t unau-6ho:;ized' conduct, ^d to , protect files 
against outside penetration. 

Discussion ' - > 

Providing adequate data security represents one of the least controvep&Tal * 
principles for health data system 'managers to fdllow: everyone will agree that "it 

'^is necessary and there are well-understood technit^ues^ that computer experts know- 
how to apply • The key issues that arise are (l) the need for management to for- 
mulate clear policies as to data access that data security measures can then carry 
out; (2) the need to make assessments of the foreseeable threats to data security, 
based on prior breaches pf information security or new risks posed by especially 
atti-active records; (3) the need to adopt a blend ot secuMty measures ' (locks on 
terminals, passwords pr.,^§c^sji^ access files, audit trails to monitor use, etc.) 
that will provide as much security as a reasonable expei^diture of, money and personnel 
can produce; and (4) the need to adopt special .measures to safeguard files of unusual 
sensitivity, such as psychiatric r^ecords in a general hospital, as by storing such 
data on separate minicompxj^ters in" locked facilities. 

J Just as no data system can be 100^ accurate^' so no system, manual or automated, 
can be made \00fo secure. This is true even in national defense and intelligence 
computer installations, where huge sums are spent on security measures and ^elaborate 
screenings and surveillance /of employees are used. jThe basic goals of data security 
in health data systems should be to block or detect attempts by the organization's 
own personnel to obtain confident!^ data they are not authorized" to have, and . to 
make the cost and trouble to outsiders of breaking into the system sufficiently high 

, as to dissuade. almost everyone from trying it, or defeat them when they do. Computer 
manufacturers, consulting firms, .industry groups, and a. variety of governmental 
agencies can usually supply whatever assistance organizational managers and their 
data processing staff may need. The adequacies of security measures can be . 
orglJiization history of threats to confidentiality in that type of 

8. The Duty to Inculcate Respect for Citizen Rights 

Principle - 1 . ^ - . : . . . 

Since there is a great gap "between publishing organizational rules or enacting 
legal rights ^and achieving positive compliance with tj^ir spirit^ and letter in daily 
life, every health data system should develop orientation programs, interpretive . 
guidelines, continuing .seminars , .problem-solT^in^ sessions, special training materials 
and annual reviews, to foster understanding and acceptance of the system's policies 
on» citizen 2*lghts by -^he organization's own^pereonnel. . Such programs should rec- 
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ognize ana* deal wlth-the special attitudes of 'major occupational groups in the organ- 
ization (doctors, nurses, other health workers, administrators, data 'processing . 
staffs, etc,.). Wherever possible, patients and public representatives should be 
' included in the deyelopmen-^, management, and evaluation of these educational progr'ams. 
" Discussion 

Operating a health organization and its data system under the kind of ethical* - 
guid-elines proposed here cannot help but. disturb' customary ways of thinking and 
behaving by organizational personnel, especially the medical professionals. Eveiy' 
organization that we studied which made important changes in its policies to promote 
- citizen rights had to develop -initial guidelines for its people, conduct orientation • 
^ sessions, review progress and. problem^ on a regular basis with its^fuli staff, and 
compile new guidelines and procedures on the basis of experience. The promulgation 
of patients rights atth^ Martin Luther King Jr. ]iealth Center, the IBM Corporation's 
revision of employee privacy policies and procedures in 1974-75, an^the way Drs. 
Weed and Golodfetz managed their patient-access-to-records projects are vivid examples 
of the Planning, communications, and evaluation efforts that go into -Achieving supporj 
for innovative policies in an on-going organi-zation. '■ , 

In dialling for buch supportive activities", as countless studies of change in 
busiwess and govej:nmental organizations attest, the attitudes of the top' management 
play a central role. If , the central administration and department heads of any 
.organization are only formally committed to the new policies, communicating a spirit 
of fesentfulness and annoyance at 'this "intrusion" into their more important affairs 
this so6n communicates- itself throughout the staff and, sabotages positive compliance!' ' 
In- the examples of outstanding Supportive programs mentioned above, the commitment 
of each organization's leaders was highly positive, >nd this was unmis-takably com- 
iiiunicated_ throughout the organization by bothtfword and 'deed. 

-It can be noted that these were citizen rights 'reforms initiated by the leader- 
ship itself, securing m.anagement enthusiasm for policie's that are required by new 
^legislation, court decisions, or professional codes may be rather more difficult, 
for example, we found a less-lhan-enthusiastic attitude toward some of the Federal 
Privacy Act's requirements among several federal agencies in the health field that' ' 
we contacted. Despite this difference between voluntary pioneers and law-compliers . 
It is still vital to the movement from new policy to daily observance that each ' 
organization Hake the kind of steps we have described. 

^' "^he ITeed for a Patient's Rights Handbook and a Patient Rights Represfentati vp 

Principle ^ ,' 

Every health ^ata system. in primary care shd^uld publish a clearly written guide- 
book on patient's rights and responsibilities that is^ given to an individual at the ' " 
earliest- point of contact with the facility. Each system should also have a person, 
who serves as a patient's rights representative or ombudsman, with the presence and 
means of contacting this representative described in the handbook given to every 
patient. While a rights hanabook and patient representative should not be limited 
to record-keeping and.^ata issues, the creation of a data system represents a key ' 
■ being!°'^ ^'^^^ already have such services to ^ing them' into 
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Discussion >^ . - ~ 

The need to inform patients that they have ri^irs -and * how 'to exe^rcisp them has 

been recognized by the promulgation of the American hospital Association's Bill-' of 

Rights for Hospital Patients, and similar codes have been issued recently for 

^ 1Q '20 

special populations, such as nursing home patients, children, an^^^ersons who 
are developmentally disabled,^^ Just what t^e nature and exercise of these rights 
should be i£ the subject of considerable discussion among health-care professionals, 
consumer and civil liberties groups, and medical organizations, but the importance 
of such codes is now firmly recognized. 

Viithin organizations creating health data systenjs, each patient ought to receive 
a pamphlet or handbook such as the one developed at the Martin' Luther King Jr, 
Health Center. The 'experience there shows that the very publication of such a 
patient^s rights document helps to orient 'the staff 'to its responsibilijties' and 
promises, improves patient-staf^^lationships , and serves as an objective guide 
for the resolution* of disputes thatS^y arise. ^ 

The critical element 'in making patients * 'rights more than a paper declaration, 
however, is the presence o^f an independent patient's rights representative to whom 
patients can complain of seek help. Such a person must have authority to investi- 
gate patient complaints, hold meetings with staff and between staff and patients 
where this is useful, and to direct staff compliance with the organization's policies^ 
where these are found to have been violated. 

How to create such a representative and assure hife/her irldependence^^might be 
accomplished in various ways. If the Organizations' philosophy and top management 
are fully committed to patient's rights, as at the Kartin Luther King Jr. Center, 
'the representative can be an employee of the institution. ^In the average hospital 
or health center, there may be problems with an employee exerting independence and 
enforcing patient rights against medical staffs or administrators. However, trying 
to overcome that problem by. lodging such a function in a government bureau or out- 
side private body, has the disadvantage of i^emoving the patient representative from 
daily in- the- facility availability, which is often critical to the needs of patients. 
The most promising approach may therefore be to .identify the role of patient repre- 
sentative as one that demands independence and advocacy on the part of the person 
filling it, and ^sing all the available mechanisms of professional and public re- 
view to see that primary care institutions permit such representatives to do their 
jobc^ in that spirit. 

10 /The Keed for Independent Audit and Periodic Review • / 

Pi^inciple • , > " * - ' ' 

^^'^'^S^aupe the use of'EDP by organizations is not a one-time decis^n as to what 
will be automated and how, but a continuous process of expanding initial, computer 
applications to additional files, new combinations of data, and more eztentJ^e data 
utilization, {often reflecting^ new technological resources) any health data system 
must be subject to regular review by an independent body. Oiich periodic review 
should focus not only on the con^iinuing adequacy^ of the organization's policies 
and data security in light of changing "data processing, p^ractices ,^ but also examine 
any major expansion of the data system that would have significant impi:.ct on ^its 
treatment^ of citizen rights, 
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Discussion ^ • 

As our. description and analysis of computer' use in health care has shown, the 
. .P5.^,.°? automatioVin primary care has begun 'to accelerate, and major expansion of 
computer use i^^lictfed in the next decade among hospitals, health centers, doctors 
offices, service payer organizations,-. and quality-care reviewing groups. If projects 
to develop- integrated information- systems Toi-. hospitals, lifetime patient medical 
histories, regional planning systems, and similar experiments progress as their pro- 
ponents believe they will, the late 1970s and early 1980s. could be a time of rapid 
change in the world of health-care computer use.' 

. Projecting this against the essential dynamism of computer applicgtions 'in organ- 
izations, and the pattern of major changes In computer, communications, and, optical 
, technologies that have marked these fields during the past two decades, good public 
policy requires ^that outside review of an brganizatiozj- s data system not be treated 
as a one-time certification process. When a hospital installs a ci^puter to process 
payroll, .personnel, patient billing, and lab testing results, it has done something 
which raises very different issues than when it later automates patient histories 
and problem-oriented records, joins a regional health planning information system 
and decides to send its patient data to an organization like the Multi-State Psychi- 
atric Information System. „ - ' 

i-or toese reasons, periodic review" by an outside body ought to be used for,' all 
health data systems. As. we noted in our discussion of who would conduct sdch reviews 
when health data systems were first'^created , or when public notice and impact state- 
ments were first installed as public policy, independent review could be through a - 
private commission or association, a state regulatory agency, or a fede^i^bod'y . 
Whichever type of review bbdy is chos^, it ought to have rights of inspection, audit, 
and testing similar to those of an outside financial auditor. or professional standards 
reviewer. ■ v « 

'*» ■ ■ V 

^1 • ^he Keed to Insure Information for Public Oversight 
Principle *• , . ' 

There is an inevitable tension between the individual's right of privacy and 
the public's right to examine and supervise how its social ' institutfons are operat- 
ing (especially when these are heavily supported by public funds). The rules of 
confidentiality set by health data systems should be examined carefully to avoid" 
adding to -the ..already existing difficulties in policing compliance with health 
program requirements ancj 'assessing the quality of health care that providers are 
giving; Using medical records without unique identifiers or with pot'entially- 
identifiable data removed represents the fiiajor technique for softening the conflict 
between privacy and public-access interests. ' - ° 

Discussion 

^The public has already become aware of conflicts between the Federal Privacy 
Act of 1974 and the newly-amGnded Federal -Freedom of Information Law, and some . 
collision between these two equally valued .interests of democratic, society -mu'st be 
-taken as inevitable, to be resolved (ideally) on a sensitive, situation-by-situation 
basis. 
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The problem with health ^ta systefes is that the public authorities that are • 
charged with policing fraud anc^ismaiaagement, and assuring the quality of^care 
paid for by public funds, are part of the same executive* branches (federal, state, 
and local) whose violations of privacy, confidentiality, and due process have been 
the subject of anxious public concern during the past decade, 

t The" task of*public policy, therefore, is to install statutes or regulations 

that are so clear as to the uses that can be made of data obtained for public over- 

> ^ ^ ' 

si£;ht, and have such workable prohibitions and penalties against misuse, that the 
.public can regain confidence in having medical records made available to health- 
agency personnel. There is also an important need to provide such, access for public- 
interes*t groups, the me(j3a, and other participants in our process of public criticism 
and review. 

Wherever possible, such access should be achieved by techoiq^ife^ such as removing 
identifiers from records, using special agencies to code .and match records .that must 
be assembled from various institutions, and securing the individual's informed con- 
sent to use his/her records for such -purposes. Where conflicts still ai*ise, judicial 
reviev; is probably the best resolution. The fe*aeral and state courts have shown 
commendable sensitivity in the past decade in balancing privacy claims and freedom- 
of- information claims. Their reluctance to accept abstract fears about privacy 
(often by highly self-interested health-care providers and government payment agen- 
cies) and their capacity to work out technique3^|j|^r making such critical personal 
records available for public review provide the basis for reasonable optimism in 
is area. ^ ' « 

12, The Importance of Research and Evaluation Usin^ Health Data 
Principle o ' 

While securing informed, voluntary consent should cover most situations in 
which medical resea'ach and program evaluations need to be conducted, through the 
use of identified data from health systems, there will be situations in which this 
is not feasible. In those cases, a health ^data system should have the purpose, . 
procedures, and safeguards of the research reviewed by a special panel, made up of 
representatives from the organization owning the data system, •outside scholarE 
high reputation, and leaders of public-interest groups relevant to the reses 
project (minority racial groups, womens* groups, civil liberties groups, el 
i'urthermore , securing a legal pri-^jilege against any compulsory disclosure of" 
research records should generally be prerequisite for a health data system's 
agreement to participate in a research Vtudy , disease register^* or program evalua- 
tion involving highly sensitive personal information. ^ 

liiscussion . , 

Just as the need for public access to health data must be considef'ed in^'setting 
rules for health data systems, there is a similar need to consider how med- 
ical research and heal th- pr og ram evalua^t ions will be affected by citizen rights 
policies. ' 

ixS we noted in Part One, there has beeA well- justified criticism of certain, 
research activities in recent years for violating civil liberties. This has * 
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included research on dependent or institutionalized people without their knowledge 
or consent, research that does harm to those on whom it is conducted, research 
whose procedures violate ethical stan^iards ,_and research that further stigmatizes 
various minor ity^roups and cultural dissidents. 

• Because our study deals with record-keeping and data systems, we nolrfed these i 
issues in Part Cne only to the extent that they involved the creation an^use of 
personal records. In our report on the impact of computerization, however/Swe saw 
that public concern over these types of abusive research activities helped fan 
public hostility to the creation of some -State computerized health data systems for 
research or evaluation. We also noted that the -failure of' many such systems to^ ' 
install cardful and detailed safeguards against misuse of research data further; 
inflamed the situation. , ^ 

Recognizing that there is a considerable amount **of rational (as well as irra-^ 
tional) "anti-research" sentiment at large today, we must also recognize that the 
importance of medical research to society and each of ils members has probably never " 
been greater than it is today. National health is deeply imperiled by harmful en- 
vironmental conditions, dangerous foods and drugs in common use, public* smoking,", 
substances used at work that produce m^jor diseases among workers, an'd a variety' 
of other conditions that must be systematically studied and reported upon if public 
health is to be protected. Further progress in dealing with major killer diseases 
cancer, stroke, and the like — depends on large-scale research. The relationship 
of chemical processes to emotional disorders, and. their responsiveness to chemical 
interventions,' is another example of prime research. N^In these and hundreds of other 
situations, researchers need access to records, usually the identified medical re- • 
cords of people tracked across ^ time and in different medical settings'. 

There are also important social interests in research to evaluate the effects 
of health-care programs and systems. The more that concepts of consumer^ cho i ce, ^ 
patienlj responsibility in health ^management , and new models of health delivery are 
put forward as alternatives to traditional jpractices , and the more that public or 
private funds are spent to underwrite experimental programs along these lines, the 
more careful and objective* evaluations of how these experiments work are needed 
for decision makers. Precisely because there are such inammoth expenditures at 
sfake, and powerful organizati^al il^terests that would be served by continuing the ^ 
status quo, the forging of political support for enacting new health programs in 
American society must be followed by commissioning evaluation studies that will, 
test the advantages of the new systems over the old, and identify what may. need 
modification in valuable new programs to correct early defects. The sine qua non 
of such program evaluation in health care is access to the identified medical * . 
records of individuals who participate in puch programs, ta compare with the 
experiences of individuals who. are receiving different care. -' ^ '^^ 

We have taken a moment to spell out- the social importance of- these research 
activities because it should remind us that the first concept we presented as a • 
guide for managing ethical data systems is that a democratic society seeks to pro- 
vide both individual rights ^d a rationally-ordered social syste^. These were the 
twin ideals that men like Jeff6a:»son dev6^ed their lives to — pursuing advances in V 
science and the useful arts to fr^^tl^pjti froi» the tyranny of nature and help 
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foster the expansion of human liberty,, 

* To carry. out that marriage of liberty and reason, health data systems should 
usiially be able to rely on the informed consent of their patients. When long-term 
research is involved, .this will require a different <kind' of infdrmexi consent than 
the short-term procedure, we. de^scri bed earlier, when release of ^pJersohal data for 
third parties such ae insurance companies, employers, or licensing bodies was in- 
volved. ' i ' ^ ' ' 

Sometimes, 'Where the research design is known at the.fime tbat , patients are 
• ii'bout to receive treatment or enter a coyirse o^ care, V full^explanation of the 
uses to be. made of personal records can be made^^oad vblq^tary written consent 
obtained* Where research projects involve going babK^o the historical records of 
patients to trace the effects of certain drugs, toedical procedures, health habits, 
or environmental conditions on the later health status of individuals, reasonable 
efforts should be made to contact those individuals' who are Ho be studied and to 
secure their consent; only if this is not possible to do, because the* individuals* 
locations are not available, should consent not be required. • 

The same initial requirement of informed consent should be used when program /. 
evaluations are being done. If evaluations are properly explained, and the safe- 
guards a£,ainst misuse of identified data are spelled out, most people will cooperate 
and let their records be used; usually, they will also be glad to supply their ex- 
periences and opinions to researchers. The argument that making this voluntary and 
having non- respondents in sa^^les will throw off the. validity of sampling procedures 
is something that m\^t, ultimately, be considered less important for soci^^..^an 
preserving individual rights. Furthermore , ^anaiy*^is of the patterns and reasons 
for non-response may well be of great importance in judging programs; where such, 
analysis is not feasible, there are still technique^ for minimizing distortion of ^ 
results in such situations. ^ . 1 
* For the exceptional research situations in which identified records are needed 
and individual oonsent csuinot be obtained, we suggest the use of special review 
panels to judge the social importance of the 'research, the procedures to be- followed, 
the risks to patient privacy that may \e involved, and the confidentiality safeguards 
'that will be followed by the reseabecher. Zixch panels should be made up of three 
elements: persons from the Organization maintainiiig the health data system; outside 
scholars of high profiessional reputation and experience in^serving on ethics cqpmit- . 
tees; and public representatives, especially from groups that may be involved as the 
subjects of the research (such as blacks, Indigms, welfare recipients, women, etc.). 
Finally, the decisive issu^ for many health system managers in deciding to authorize 
a research project may be- whether there is an adequate legfil privilege available to 
protect identified records from compulsory production in ^y investigative, prose- 
cutive, or administrative proceeding by any governmental authority and from produc- 
tion in civil litigation. Statutes providing such privilege have been passed by 
Congre^ to cover some executive-designated research ^projects on alcohol and drug 
abuse. State privilege laws have also been enacted for some special research, 
such as Maryland *s statute extending total privilege to the data s'ubmitted by 

23 

public and private mental health practitioners to the state psychiatric register. 
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>, J, However, d'^spite arguments in tne courts that such a privilege is guaranteed 
by constitutional i^l^ghts of privacy, and despite efforts to enact researcher's, 
privilege laws at the state or federal level, the fact is that a general privilege^ 
for sensitive research data does not exist today. One solution would for health 
professionals, medical societies, and health agency leaders to join civil liberties 
and media groups in campaigning for such research-privilege laws. But if the 
complexities of covering the media, general academic research, piiblic-interest 
research, and medicaJJre search all in one statute prove to be insurmountable, then 
an alternative st^;^^ would be to draft a inodeL law giving legal^rivilege to 
medical; re'Jiearch; by itdelf,' This would be politically promising, sinpe the public's 
intere^ irf the' security of medical research data is great and %he justified Aeed 
to 'procjt^ce it for law enforcement or defendant's rights purposej^^ill ^u*ise less 
often -thah with media or pu\?lic-interest research data. If important resea;rch 
utilizing ^personal information from health data systems is no')? to be thwarted in 
-the coming decades, installation of such protective legislation must be a high 
priorit:^ for health groups. 2^ 



C, CURRENT PRIORITIES FOR POLICY ACTION. ^ ^ 

The work of refining and applying these twelye principles for health data%ystems 
is clearly a long-range task;, it is alr:eady under way in some sectors (as where 
government* health agencies are under fair information pi*actices laws) but there are 
other iareas^ pr^arily'' in the state and private sectors, in which the job has barely. 
* begun, \ ^ - • . 

It was not thS assignment of this studv to go beyona the presentation*^and analysis 
of broad standards to formulate, detailed recommendations for policy action. However, 
our investigation of emerging citizen rights problems in the health field does mal^e it 
possible to identify an agenda of issues that now seem ripe for action. We will 
mention^ examples of issues that require action through legislative, judicial, 
organizatioi^al, and citizen-group initiatives, to stress our conviction that such a 
ixture pi: interventions^ is vital to intelligent policy in the coming years. 



m 



1. - Legislative ^iorities t 

Some ^legislative actions involve pin-pointed reforms, in the recognition that 
society does not think it wl-^e to let these matters be worked out slowly (and 
uncertainly) through judicial decisions or the fair information practices law route.^ 
For: example. Congress ought to bring the use of medical information in credit, 
employment, and insurance reports ut^er the protections of the Pair Credit Reporting 
Act. One can understand why the legislators in I970 decided not to include such 
^•data\^ien they 'took their first major step *tc regulate commercial reporting services',' 
but the^^record^ of- the past five years has made it plain that consumers deserve to 
have access rights when medical data is used to deny them credit, insurs^nce, and- 
empldtoient. There are important issues to work out in sych an.amendment to the 
1970 «bt,, such as whether the individual Would see suqh infjjrmation directly or have- 
a physician of his choice receive it. But the need to remove theroedical exemption 
•from this consumer-protecticn law flows directly from the -principles presented earlier,- 

nothing presented by industry -spokesmen at hearings on this issue is persuasive 
to the contrary.^ ' '1 ^ ^ 
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Enactment of medical-research privilege laws at the federal and state levels 
Is another specif i^c legislative ^action that deserves priority treatment • ^ We have 
already discussed the absence of such legal privilege today and the continual . 
pressures on such data-Xrom law enforcement officials, administrators, and othet 
gbvemment bodies. X carefully drafted medical-privilege statute ought to command 
wicie profess ional^d public support, ' , 

Given the confused and uneven laws in^the 50 States on confidentiality of 
medical information and patient access to records, the development ^f a model statute 
'and its enactment by a"s many states as possible would be an important step towar(i^-' 
modernizing citizen rights in this area. The American ^Medical Association has been 
working on the draft ^^such a model ^tatute for several years, and *their latest 
version is included in Appendix 3 of this report. While there will be important 
^differences between the AM^and other groups on some aspects of this law, the AMA ' p 
model bill represents an excellent starting point for jiiscussion, Jf civil liberties 
and public i^ter^st groups could work cooperatively with the mediciil profession on 
refining thia a^i ro ure , and agree to disagree where that is called for, this coalition 
could jTtovide th^ driving force for state legislative actioo* Similar coalitions 
be-^we^^ptyil liberties groups and bankers associations have been important in 
f igh|^ng ^or privacy of bank records, and a coalition between civil liberties ^oups 
and lab^r run ions produced the state laws enacted recently to control compulsory use 
of polygraphs by. employers folr hiring and other -employment decisions. 

With only 5 states having enacted 'fair information practices lawsi anyone « 
concerned v^ith the protection of citizen rights in state, county i and municipal health 
facilities lought to be pressing their states -to join Minnesota, Massachusetts, Utah, 
Arizona, anii New Hampshire in placing government data uses under protective legislation. 
Indeed, as ^he Privacy Protection Study Commission hold9^ its hearings in 1976 into the 
-administration of the federal and state privacy acts, and varites its report on the 
successes am'^ problems that have surfaced thus far with such laws, a stronger and 
improved modi^.l of th^ Pair Inforination Practices Law Tnay be developed for other states 
to adopt. \ . ' ^ 

Finally, Wxplicit citizen ^•ights provisions and a general administrative system 
that facilitates such rights should be installed in any nationad health insurance 
program enacte<i by Congress, The confidentiality and indiridual-access policies just 
enunciated \>y Hfew to govern professional standards review (PSRO) for ^Medicare and 
Medicaid are excellent standards, and while thei*e is no experience yet as to how well 
they will work, these policies could be drawn upon for national health insurance bills 
and regulations. Many of the principles discussed in this chapter are already in 
the.se^PSRO policies and could T)robably be adopted for national'^health insurance with- 
out too much struggle. However, several ^^areas- of sharp ^controversy can be predicted. 

While some will see national. health records as valuable sources ^or other 
^social "purposes, protection of citizen rights requires that the law have provisions 
declaring that national health insurance d^a can bo; used bnly f oi: administration and 
^ evaluation of the insurance program, and that identified records will not be accessible 
for^any other governmental or private purpose (such as location of desert ipg fathdrs, 
income tax enforcement, police investigations » pr^ivate" lawsuits, etc*) ^ 
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Some legislators will wauit to follow the easy path of using the Social Se(Mfrity 
number for this system, but use of a unique national health iAsurance number would 
pz:otect citizen^rights by not having medical records include a number that; is often 
known to others and whose presence in these records would facilitate their linkage 
with other files. ' 

The tendencjT of many experts designing the administration and data systems of a 
national health insurance program will be to have summaries of identified records for 
every participauit held in one file in Washington, as Social Security records are now 
he 14. They will also wauit to have patient-identified records of easels on appe'al for 
denial of payment or provider fraud also sent up to regional offices and to Washington. 
Here too, proper concern for protection of citizen rights should lead* to a rejection * ' 
of such approa(jhes in favor sif a system that has identified records k?pt only at the 
local level, with the local agency generating a special, randomized review number and 
removing all unnecessary personal information f^om amy record sent up for review to 
regional or national office^l ' Since the provider's identity would be preserved in all 
records, this, ought not to interfere with the audit trails necessary to police ^igainst 
suspected fraud or misconduct. 

Finally, some legislators will want to use the •'doctor-knows-best** principle to 
govern an^individual 's access to hisAer record in the national health insurance 
system. ' Following the principle already presented in this chslpter, we believe that 
if a medical professional has not been able to convince a patient through personal 
counselirig that direct patient access is unnecessary or unwise,, then refusing such 
access cannot be in the best interests of the patient or consistent with the 
professional obligation of the physician, and access should be permitted by law. 

2, Judicial Action^ . ^ 

Test cases are the accepted way that individuals and groups seek to activate the 
American state and federal judiciary to advfiuice citizen rights. We have reported 
quite a feyt Moh test-case actions in Chapter 11, and we learned of new ones being 
filed even as we wrote these concluding remarks. But beyond such specific 
lawsuits, we think there is a broad strategy, thai; ought to be directed at the courts 
in the coming* ytfars, to establish the common law .of private organizations and 
the constitutional duty of government orgsmizatiorls to take reasonable care in the 
way they handle sensitive personal health data. Wjiere this is set by statute or 
regulatory order, of course, that *would define such ,a duty and make it enforceable at 
law. But even, in the absence of such laws, we thinik that there is a failure of legal 
duty whenever a health data organization does not aliopt (a) explicit policies to assure 
rights of privacy, confidentiality, and individual acoess; (b) procedures to assure I 
appropriate levels of accuracy, timeliness, and completeness 1 and (c) adequate data 
security measures to control improper uses. What constitutes sufficiently explicit " 
policies, appropriate accuracy, or adequate security measures would be defined 
according to the type of or^^izatfoh and activity involved, arid the existing; state 
of the art in data security equipment and technique?. Lawsuits cpuld -be brought either 
by individuals whose interests in privacy and-medical care were threatened by 
organizations using their data without meeting such standards, or by public-interest 
groups sponsoririg class-action suits in the same vein. 
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It can be argued that setting such standards should be the work of legislation, ^ 
executive order, or regulatory-agency . action, and that invoking the courts Is neither 
responsible public-^policy for a democratic society nor a good way to hammer out the 
detailedVailes so often needed. It could also be argued that this would not give 
organizational managers and computer-systems devej^opers ^the advance rules they need 
to avoid ambiguity, and to help justify committing money and staff to the task. Yet the 
genius of the American judicial system has been its ^development of new duties for 
•private parties (wid redefinition of constitutional rights) to reflect new business 
activities and technological chsuige. In the common law, this was the way new concepts 
of contract were developed for mercantile capitalism, and new concepts of tort law 
for industrialization. Judges today could be equally creative in defining the legal 
duties of those who use information technology. A failure of duty would be careless 
and negligent treatment of sensitive personal data, and successful practices would 
.show what is reasonable ^aiyi practical) to conduct. After several leading cases had 
set the main lines of acceptable and unacceptable conduct, the organizational 
managers and systems developers would have the guidance they sought, and so|U.ety 
would have^ activated an important way of acnieving continuing review of orgm^zational 
r espons ibi 1 i ty . 



^ 3» Organizational Responsibilities v ^ - . 

^ Legislation and judicial decisions^ take time, imd it would be ui>^eSLristic ta 

J:hink that many of the priorities just discussed will be installed immediately. This 
leave-s the immediate initiative for ac^'ion with organizational managers, furthermore, 
the standards that will be used by legislators and judges j are often drawn from good ^ 
as well as bad organizational practice in the industry or programs being regulated. 
This means that the interests of organizational managers in avoiding unVise 
regulation as well as in the discharge of their own leadership responsibilities makes 
it important for managements %o address such citizen* rights/ issues themselves. 

We think any organization maintaining a large-scale d^a^a .^System ought to conduct 
^ the kind of serious, in-house ••privacy audit- of its principlea, policies, practices, 
and procedures that IBM did in 197^-75 i that most federal agericies did in 1975-76 in 
preparation for complying with the Federal Privacy Act'i and that many businesses have 
been doing in I976 to see that they(^e not engaging in controversial' practices 
_ that would support tW enactment of proposed federal measures such as the Koch- 
-Goldwater Bill, H.R'. 1984. Such a privacy audit should surface the real problems in 
the organization! its prime advantage is that it then allows managements— with 
whatever outside help they may need— to deal with those issues directly and carefully, 
rather than having the problems accumulate and worsen through management inattention, 
unfocused data-system decisions, and similar' developments, ^ • 

At the same time, mamy professional groups have been working recently* to 
formulate new sets of guidelines to deal with citizen rights issues in the h«alth 
field. These iriclude new guidelines from Blue Shield, the American Society of Internal 
^Medicine, tM American Psychiatric Association, community health centers, social^ 
wofkers, nursing home operators, and many others The concept of creating and 
legalizing -ethical data center^; Hhat -Dr, Elmer Gabriell and his colleagues have 
advocated offers another valuable source of guidelines to draw on,^^ The enunciation 
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of such guidelines -has played an important role in American society in defining good 
pf^ice and professional st^dards/ and it deserves |to be used to the fullfiat_in/~ 
extending citizen Rights in the health field. 

Cititen Group Actions 
Beyond health-professional orgsmizations, our stj^y has shown that the American 
Civil Libei^ties Union has played the single most impor^tant" role in raising citizen 
• • rights issuefe during the past few^ears. This has befen not only through the ^ 
activities of the ACLU Nati^al Office and its' state affiliate chapters, but also ' 
through various projects tllrected or supported by the AlS-Ur.such as the Mental -health 
Law Project, the Prisoners' Rights Project, the JuvenilJ.Rights Project, and the 
Project oh Privacy and Data Collection. One does not have to agree always with the 
position taken by an ACLU chapter or the national office to recognize that the 
continued attention— indeed, the increased attention—of ACLU 'to health-data issues is 
going to be essential to the working out of good policy.in the coming years. 

Beyond that, the recent formation of the National Commission on Conf idertt'iality 
^ of and Access- to Health Care Records is a promising development. -Composed of l8* 

leading organizations in the health field, and growing out of the excellent conference 
on confidentiality held in Key Biscayne, Florida in late 1974, the Commission coJld ' 
well sponsor just the kind of activities in research, legislative-drafting, corisulting, 
and public testimony that is needed to giva coherence and a consensus-forming 
mechanism to efforts in this area.-^° 

Finally, is there any^ special role- to be played by computer professionals in the 
protection of citizen rights in health care? It can be argued that computer 
professionals can make their best contribu^on within, the organizations they work for • 
(e.g., hospitals, state health departmentSf etc .) ^ ^s. private citizens pacticipating 
in public debates over databank issuesi in meetings dealing with medical computing, 
such as the MEDINFO conventions i or»,tfirough the general activities of computer groups " 
such as the Association for Comput|iig Machinery, the American Federation of Information 
Processing Societies, and 9inilar|^^ups. These are all important activities, yet 
there is an^additional one ;^fiat de|8efves consideration, when particular government 
data systems are being conajldere'd' in local communities or at the state level, whether 
these are systems in cri^tirikl justice, welfare, health, taxation, or other fields, % 
informed computer profess i^^nals can do a great deal to help the public interest groups 
concerned about citizen ri^ts to understand how such proposed systems will work, or 
how existing systems are w<^Jcing, The computer professionals can also suggest how 
protections can be worked out within such systems, what the costs are likely to b?, 
and -how such systems cou-ld Ue effectively monitered. In addition, whenever public 4 
advisory groups or independent audit groups are set lip for such data^systems, the ^ 
addition of citizen-rights oriented computer professional not employed by the 
government is usually essential to such a group being Able to exercise meaningful 
oversight. • 

. Sometimes computer-professionals volunteer for this work or do so as members of 
the public-interest or civil liberties groups. ,But the relative infrequency of this 
Professional- participation' (not only in the health field but in others as 'well) suggests 
.that we may need •some--teind:~of-6rganizatipnal assistaricer If- the. major computer" " 
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a3Sociations# both nationally and ^through their ^oc^l chapters,, could publicize the 
availability of ^volunte^fr^xperts to help 'citizen groups, or to serve on public 
advisory, committee^^ and oversight committees,,, or to advise legislative comral'ttees 
needing'help in sorting out the issues, this might provide the kind of linking 
mechanism that doets not to be in place yet in the thousands of local communities 

and state capitols where the tens of thousands of personal data systems are being 
built, e^Qpanded, and regulated, ' •.V~> 

CONCLUSION e ^ - c ^ 

As Amerrican sofciety redefines and reorganizes its health-care system in the 
coming decade, it will have to make increased use of computer techno-logy to majiage 
the rivers of data that will be generated. Vital medical reseairch, public-health 
studies, and environmental controls will also reqjiire increased reliance on EDP, ^juat 
as there will be powerful benefits from EDP for individual health care, in the . 
development of permanent patient histories, emergency-treatment communications systems, 
and similar, patient -oriented activities, 

*^If the question is not whether but how such technology will be used in heal'th 
carp-, American society has one non-negotiable condition for this process j basic 
citizen rights cannot be made a casualty of technologj^assisted health systems. To 
do so would be to betray the tradition of Hippocrates, and ultimatdly^ to dehumanize^ 
health care itself-, * ♦ 

It is the custom <ff Americans to believe that no .**lady-or-the -tiger" choice has 
to l}e made between science and liberty. For 200 years, in the tradition of Franklin 
and Jefferson, we )iave hamifiered out -legal rules that allowed each successive 
wave of invention to realize its potential, but, also required each to be brought \ 
under the rule of law. Sometimes it took a while for the principles of regulation to 
become clear, and we have come to realize that' the awesome effects of contemporary 
technology give us less lead time for social lesirning and regulatory response than we 
Had in eairlier eras. But lhat is the challenge we face, and there are promising^ o 



signs that pur socie'ty understands how impV];tant it is to develop* soon, the standards 
by which we can pursue the benefiHis of both, science and, liberty in the field of health 



care , 
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PROJECT DOfcUMENTS 



, . -22 EasUOth Street New York, Hy/^OIS (212) 725-1222 ' 

July 15/ 1974 ' • 

/ 

To: Affiliates and Local Chapters 

From: Alan F. Westir^, Chairman, Privacy Committee 

•As you know; the' Privacy Committee proposed to the ACLU National 
Board, and the ^Boardlf^ecently adopted, an important policy 
st;atement on -protecting the privacy of patient medical Records, 
controlling the cir<;ulation of confidential medical information, and 
giving patients a right of access to their own medical records. Thes 
issues are ^^oing to become more important as plans for national 
health insurance move forward, as Professional Standards Review 
Organizations (^SRO) begin operations, and as^medicarl records 'aiM 
registers are computeifized in governmen^t databanks and private ^ 
organizational files, * 

I ^m writliig to you to ask whether you can report: 

1. Any specific cases, and. issues in which breach of patient medical 
record 3^ rfcpdical information has come to your attention,. Clipping 
briefs, o^^ewsietter reports would be greatly appreciatedr^any 
costs of reproduction or mailing .will -'be" reiiTibursed . 

2, Any examples of computerization of medical records in your area 
or state--by local or state government 'Agencies or' private 
institutions — that you have noted and taken any action abput. 

♦ 3. Any recent policy resolutions oTr staff representations (through 
letters or testimony) on these matters. * 

I would be most grateful if you coyld send along anything you have 
'on these matters, ot turn this letter over to the specialist in youi- 
affiliate*' who may follow such topics. 

» Many\hanks for your assistance. 

Sincerely, ^ / I * 

• Alan F. Westin ^ ^ 

AFW;lc V , ; 

^ P.S, Please send all replies to my home address ; 9 6t)- Lincoln Place, 
Teaneck, New, Jersey 07666. 

Edward J Ennls,.Ch.ufman. Board of Directors • Ramsey Clark. Chairman. National Advisory Coun6n' 
Aryoh Noier. Exoculivc? n»roCtor Executive DoparlmCnt Alan Reitmtin, Associate Director • Roger N. 
Baldwin. Executive Dirccior Emeritus and Inlernational Work Advisor • Trudy Hayden. Brian Hellernan, 
Carol Jennings. Philip Ryan, Helene Toiv, Slall Associates. 

(100% recycled papor) — > * - 
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TB^e^^Ci^§ll.ilbertges Review 

22 Easf40th Street 10th floor New York, New York 10016 (212) 689-8142 or 7:5-1222 



Aid. - V'«t$''n 

CG 50' 



October 31, 1975, 



To: Affiliate Directors 
^ From J Alan F. Westin 



In the sununer of 1974, as chairperson "of the ACLU Privacy Comhiit tee 
I wrote to each ACLU affiliate asking for information about local dases 
or incidents involving violations of prlva'cy in medical or health records. 
I obtained many excellent r^pUes, and have followed these up with raanv 
of you. - _ - 

. » 
Now, I am revising for publication a report on the civil' liberties 
problems involved in manual and domputerized files containing personal- 
health data. The report covers whether- medical or health data ought to 
be collected at all in a particular setting (employment, education, 
licensing, etc.); whether data- cpllected is being held confidentially 
or IS being disclosed to some persons inside the collecting organization 
or outsiae m wno ought noc co-receive that informa.tio.-.; and whether 
pati-enbs or othejr individuals who have disclosed thei'r health datd are ' 
given a right of access to their own" records, if they seeJc that. 

Could you tell me whether you currently have any incidents, protests, 
lawsuits legislative activity, or other actions involving- these issues? 
I am collecting episodes covering bfith manual records and computerized 
records. ~ . ' • . 

^ I hope to feature an accurate and strong presentation of how peoDle<s 
rignts in health data are being treated today, and I would be most" " 
grateful for any letters, clippings, legal papers, or other reports that 
you can send me. ' 

Would you please address, your replies to me- at: ' 

The Civil Liberties •Review ' ■ ^ 

' ; 22 East 40 Street, 10th' Floor 

New York, New York 10016 ' * , ^ 

feny thanks for your help. . . ^ 
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^ - ■ PROJECT ON MEDICAL RECORDS AND CITIZEN RIGHTS 

* Spo(?«ortd by ttM Mititui* for Comput»r Scl«nc6» and Technology, U,S. Nctional BufMU Of Standards 



Dlr««t» 



960 Lincoln Plac«, TMn«cV, New Jersty 07666 

$INCIDBNT^ REP 0 R T 

't» * ' ' ' ' ' - I' " mm m 



This Project, as part its study off the ways in which automation of 
personal m^dieal records may be affecting privacy, confidentiality, and - 
patient access to records, is collecting accounts of incidents in which 
confidentiality of medical records has been violated, or attempts have been^ 
made to violate such confidentiality, either in aanual or computer^ files > ' 

Please describe any such incident that you know of iri the space below. 
Either give it to the member of the Project that you al^in contact with 
or mail it to the Project, at the address shown above. THAIHC YOU FOR YOUR HELP 



Incid ent 
— 



USE BACK OF SHEET IP*NECESSARY FOR CONTINUATlrON ... 



NAI4iS OF PERSON CONTKxi>utlNG INCIDENT 

/ 



ADDRESS 



(The name of a person contributing an incident will only l3e used ^ after 
contacting that person aod obtaiziixig agreement for such identification) 



344 



PROJECT ON MEDICAL RECORDS AND CITIZEN RIGHTS 

SpontoTid by th« inttltut* fofComputir Scl«nc«t tnd Ttchnolofly. U.S. Nttionil BurMu of Stimdirdt 
960 Lincoln Plact» T^anecK, New Jersey 076M 



Oir«ct« 

AIM m0Stl» 

CofMMltMt 

M'CA4«; A. B*k9/ 

Btooktyn Colf^ 
City UniVfsitY ol N y 
IWMsrdt SUtf 
J«m/» Btod9i 
R'Ch^ta 5ilb0fb*fg 
H9m% To,v 



FORM LBTTOR SEIT TO IfeDICAL 0H0AII2ATI0HS 



BAMS ABB ASDBSSS 



A^^^JI^ auspices of the U.S. National Bureau of Standid^, i am 

research project on citizen-rights issues involved in the 
automation of medical records. We nre looking at how patient records are 

S^-iLn'^r ^- ^ clini"' how lomputSization il affecttnL 

such , record-keeping and the circulation of patient data for repayment ^ 
purposes and satisfaction of legal reportinrduties; and the isSies of 
iS nfw^^o™::"^''^*^?'^?^' P-tient-access-to-recird* thS? a" involved 
n?»nr*-« Of JMdipal services, from PSRO and national health insurance 
°^ large-scale medical research programs and raedlaal" 
registers. A brief summary of our project is enclosed. " 

to «h<-»?n*''!„Tf i"*' ^ major professional prganiiations in the iiej^lth f ikd 
to obtain copies of any xecent policy statements, reports, or other jnaterials 

^rS^^ H^^"^ °" ^« °^ P^^^^^^y and:confiden;iafi?fbf Cdica? 

l^lflk t J^L^" °l «'»P'»<=eri2atiprf in patient recSrd keeping, 'wi 

%?i ^.^'Tf?' *2 collect accounts .of rWi^ent episodes in which the 

f ? ^ ° medical records^ w* violated,_either for political 

^rS^S ^° governmental interests th^ 

were held to be superio^to the privacy of the patient data. 

Jk??"^^^*^ "^^^ grateful learn what your group can report or may ' 

]^nt i""es, and I k^ow that reiders of our^tu^ will 

want to have your views represented. / ' 



Sincerely yours. 



May we hear/from you sqon? 




Alan P. tf estln 
Project Director 
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Medical Organizations Contacted 



National Geriatricfs Society 

Lister Hill National Center for 
Biomedical Communication 

Special Interest Group on 
Biomedical Computing 

Amej^ican Association of - 
^^edical Clinics 

American College Health 
Association - 

Association ofi American 
F^dical Colleges 

Institute for Advamcement of 
iVedical Communication 

^?edical Correctional Association ^ 

Electronic Computing Health 
CTientea,Inc, 

Institute for the Study of 
Health and Society 

American Hospital Association 

Amerrcan .Osteopathic Hospital 
Association ^ 

Association of Medical Super- 
*-intendants of Mental Hospitals 

Commission on Professional arid 
Hospital Activities 

Hospital Management Systems 
Society 

Association of Life Insurance 
Medical Directors of America 

American Collie of Physicians - 

American 'Society of Internal 
• Medicine 

American ColjLege of Obstetricians 
and Gynecologists ^ 

American Osteopathic Association 

American, Academy of Pediatrics 

American -Pharmaceutical Association 

Drug Information Association 

American A*cadeiny of Family 
Physicians 



American Dental Association 

National Association of 
Disability Examiners 

Group Health Association of i America 

Blue Cross Association 

National Association of Blue 
' Shield Plans 

'American Academy of Health 
Administration 

Assembly of Regional Health 
Planning Organizations 

National Health Federation 

American Association for 

Comprehensive- Health Planning 

American Medical Association 

National Medical Association 

American Medical Record Association 

American Association for the 
Abolition of Involuntary 
Mental Hospitalization 

Association of Mental Health 
Administrators 

American Nurses Association 

American College ^of NursJ.ng 
Home Administrators 

American Nursing Home/Olssociation 

Citizens for Better flare ia Nursing 
Homes, Homes-£pr the 4ged and J 
Other After-Care Fgteillties 

Medical Liberatic^n Front 

Association for f^ealth 

American School Health 
Association 

Student American Medical 
Association \ 

American College of Surgeons 

American^Venere^ Disease Association 

American Medical Women •s Association 
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Physic isms Forum 

Americem Psychiatric Association 

American Public Health 
Association 

Atomedic Research Center 

Brain Information Service 

Health Sciences Coimnunications 
Association 

American Association of Dental 
Schools 

Living Bank 

Amer,ican*Society for Hospital 
Pharmacists 

Association of AmericEm Physicigms 
amd Surgeons _ 

Association for Psychiatric 
Treatment of Offenders 

National New Professional Health 
Workers 



Americfim Medical Writers' 
Association , 

American Geriatrics Society 

Americfim Chiropractic Association 

International Society of 
Cybernetic Medicine 

National Environment Health 
Association 

Americfim Academy of Medical 
Administrators 

Americfim Association of Medical 
Assistfimts 

National Association of Private 
Psychiatric Hospitals 

Americfim Society for Medical 
Technology ^ 



-3^ 



ERIC 



347 



367 




2. PRIVACY DEFINITIONS, Developed by Dr. Willis H. Ware, HAND Corporation, 
September 23, 1975. . * 

1* " Privacy 

The right of an individual to be left alone; ^ withdraw from the influence 
of his environment; ^r to ^e s^luded, not annoyed, or not intruded upon. By 
extension, the right to be protected against physicalyOr psychological invasion 
or against misuse or abuse of something legally owned by an individual or normally 
considered by society to be implicitly his property, e^g., one's home, one's 
solitude in a public place, the right to maintain something for private use or not 
available to others. ^ 

2. Personal privacy (or, information privacy) ' 

(1) The claim of individuals, groups or institution^ to determine for 
themselvies when, how, and to what extent data about them is jseamiunicated to or 
used by others; (2) the protection of an individual against harm^or damage /as a 
result of the operation of a record system; (3) the protection of an individual 
(or class of individuals) -against unwelcome, unfair, improper, or excessive 
collection or dissemination of information or data about himfself . 

3. Personal (computer) privacy 

The protection of one or more individual(s) from harm or damage as a result 
of abuse or misuse of personal information held on him in some record system. 

4. Invasion of privacy 

A violation of some aspect of privacy or personal privacy as defined above; 
in the record system sense explicitly, harm or damage ^o one or more individual(a) 
as a result of the operation of a record system. 

5. Data privacy 

The protection of data (typically in a computer-based system) for the sole 
use of one indij^id|^l or organization, or by such others as the owner of the data 
may authorize, e.g., other individuals, organizations, agencies, or groups thereof. 

6. Confidential ( ity ) ' > 

(l) Status accorded to data or information indicating that it is sensitive 
for some reason, therefore needs to be protected against theft or improper use, 
and most be dissei^^inated only to individuals or organizati^ons authorized (or 
privileged) to have it; (2) by extension, status (sometimes assured by law) 
accorded to data or info rma;t ion that reflects an understood agreement between 
the person furnishing the data and the person or organization holding it that 
prescribe^^^e protection to be provided and the dissemination and use to be 
permitted; (3) a legally recognized relation between certa-in individuals (e.g., . 
lawyer- client) that privileges communications bet\/een them from disclosure in 
court. (Sometimes, confidential information is legally required to be given in 
exchange for some benefit, privilege, right, or opportunity; sometimes it is 
voluntarily given.) 
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7. Computer security 

The totality of measures required to (1) protect a computer-based system, 
including its physical hardware, personnel, and data against deliberate or 
accidental damage, from a defined threat; (2) ^protect the system against denial- 
of-use by its rightful Owners; and(5) protect data and/or programs and/or 
system privileges against divulgence to or use by unauthorized persons' 

^fi 8*. Network security 

Ihe totality of measures required to (1) protect a network including its 
physical hardware, personnel, and information or data against deliberate or 
accidental damage; (2) protect 'the network against denial of use by its rightful 
Qwners; and (5) protect the information or data in the network against divulgence 
by unauthorized recipients. It includes as a componenjb^^ computer security > 

9. Data security 

The safety of data from accidental or intentional but unauthorized disclosure, 
modification, or destruction: 

10. Integrity (of data or systems) 

The property of being what an item & thought to be, and therefore free of 
surprises. ' ^ ' 

S 11. Access control 

ThQ set of measuafes (including administrative, -procedural, computer hardware, 
•^d computer software) that (1^ limit access to a computer system to only 
^ individuals authorized to use it; and (2) limit access to inforination data 

or/ programs within the system to only legitimate users authorized to have them. 

12. Seepage ■ , 

The flow of data or information whose access is presumed to be controlled 
by computer 9e9urity safeguards, to unauthorized individuals who obtain it by 
circumvention or direct penetration of the system safeguards » 

15. Linkage 

The combination of data or information from one information system from that 
from another; in particular, the combination of computer files from two or more 
sources. 
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Represented' 



To Provide For Confidentiality 
Of Health Care Information 

' Be it enacted by the People of the State of 
in the General Assembly: 

'^^ . ' - ' 

Section Is This Act may be cJLted as the 'Confidentiality Of 
Healtli Care Information Act". 

Section 2. The purpose of this Act is to establish ^safeguards 
for maintaining the integrity of confidential health care information. 

Section 3. For purposes of this j^ct — , 

(a) the term "health care provider '^^^geans any person, 
corporation, facility or institution licensed by^hls state to 
provide or' otherwise lawfully providing health care Services , including 
but not limited to a physician, hospital ^r other hqblth care facility, 
dentisty nurse, optometrist, podiatrist, physical therapist or psycolo- 
gist, and an officer, employee or agent of such provider acting in 
th^course and scope of his employment or agency related to or sup- 
tJ^tiye of^ health care services; 

(b) the term "health care services" means acts of 
diagnosis, treatment, medical evaluation or advice or such other acts 
as may b^ permissible under the health care licensing statutes of 
this state; ^ 



/ (^1^) the term ?^onf idential' h'eall: 

information relating to P person's heal^ care history, diagnosis, 
condition, ti;eatmeni', or evaluation; 



^care information" cleans 



(d) the term "medtijal-peerp^view committee" means a com- 
mittee of a state or local proi^S^Jonal mec{i<:al society or of a 
medical staff of a licensed hosp^al, nursing home or other health care 
facility provided the medical staff operates pursuant to written 
bylaws that have been approved by the governing boArd of the hospital^ 
nursing home, or oth^r health care facility, or other organization of 
physicians formed pursuant to' state or federal law and authorized to 
evaluate medical and health care services; j 

(e) the term "third ffarty" moans person or entity 
other than the- person to whom the confidential health cure inforraii- 
tion relates and other than a health ^;ftro provider. 



-Aincrioan M.-.Uoil Xssooiition, Lou'Ulitly? tk»pirt iiout,. Public Afi-iirs OlvlUou- 



350 

^ 370 - 



1 Section 4, (a) Except as provided in subsection (b) or as other- 

2 wise specifically provided by law, a person's confidential health*care 
y * 3 information shall not be released or transferred without the written 

4 'consent, on aCconsent form meeting the requirements of section 4 (d) 

/ 5 of this Act*, of sul:h' individual or his authorized* representative, 

6 A copy of any notice §sed p^rsuant to section 4 (d), and of any sl^ed 

7 consent shall be py^yided to the person signing a consent form, 

8. ' ^: A ^ 

9 (b) No consent for release or ti'ansfer of confidential health 

10 care information is required In the following situations: (L) to a 

11 physiciart, dentist, or*other medical personnel for diagnosis or treat- 

12 ment of such individual in a medical or dental, emergency , or (2) to 

13 medical peer- review committefes, or (3) to a State Insurance Department 

14 or other state agency for the purpose of reviewing an insurance claim 
' J 15 or complaint made to such Dep^tment or other agency by an insured or 

16 his authorized representative^ or^by a beneficiary or hi^ authorized 

^ 17 representative of a deceased insured, or-(4) to iqualif ied personnel 

1^ for. the purpose of conducting scientif icr.research, management audits, 

19 ' financial audits, program- evaluations , or similar studies, but such 

20 personnel shall not identify, directly or indirectly, any individual * 
^21. patient m any report of such research^ audit, or evaluation, or other- 

212 wise disclose patient identities in any manner (the tero "qualified 

; * 23 > personnel" means persops whose training and experience arp appropriate 

* ' 24 to the nature and level of the work in which" they are^engaged and w|jo, 

, 25 when working as part of an organisation, are performing such work with 

*' . 26 published and adequate adonis trative safeguards against unauthorized 

.^27 disclosures), (5) by a health care, provider, ad reasonably necessary 

' * 28 in^the provision of health care services to a pcfson, or in the 

* - 29 administration 'of the office' or practice or ojieration of a he^^lth 

30 care provider (agrused herein ,'*-adminfstration" shall include', but 

31 not be limbed to, purposes of: accreditation, reimbursement,' 

32 .liability risk management or appraisal, and defense or^prosecti$ioi> of 
^33 legal actions), or (6) by an employer y reasonably necessary in the 

34 administration ,oT a group Insurance or workmen's compensation plan,' 

35 or ^7)-^npdh-the filing of a claim for insurance benefits, between 

' 36 third party insulrers to determine their relative rights a^d obliga- 

« > * 37 tions concerning the individual's entitlement or. the aMount or kind 

, % ' 38 of insurance benefits, when the policy of insurance obtained by the 

' 39 individual provides for obligations by more thah one insurer with respect * ' 

\> , ■> 40 to a claim for ^benefits. 

• .-41 - , : 

-"^^ 42 The release 'or transfer of confidential medical information 

43 , under any of the above exceptions shapll not b^ the basis for any ^ 

' 44 legal liability, civil or criminal, nor considered a violation of. 

45 this Act. r • • - ^ 

' - ' ,46 p-. , . ' 

^ . "47, (c) Third parties rocoiving»and retalninR an individual's con- 

48- fidential hcjUth care information must establish at least the follow- 

49 ing security procedures: (l) limit authorized access to personally . 

^50 identifiable confidential Hicalth care information to persons having 

t 51 a "need .to- know" si^ch information; additional employees or afents 

52 may have Access to such information which does not contain information ' < 

53 ^ from which an individual fcan be identltfiad;^ (2), identify an individual 
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or individuals who have responsibility tor «a inta in ing' security 
procedures for confidential health care inforaation; (3) 'provide a 
writ tea statement to each employee or agent as to the necessity of • 
maintaining the security .of confidential health care information, and 
of the penalties provided for in this Act forSiir:unaithori2ed release, 
use, or disclosures of such information; receipt ot such statement 
shall be acknowledged by such employee or' agent signing and returning 
same to his employer or principal -and the employer or principal shall 
furnish his-employee p? agent with a copy of the signed statement ^ and 
shall retain the original thereof; (4) tajte no disciplinary or punVtive 
c^ct^ion against any employee or agent who brings evidence of violation 
of this Act to the attention of any person or entity. 

(d) Consent forms for the' release or transfer of confidential 
health care information shall contain, or in the course of an applica-, 
tion or claim for insurance be accompanied by a notice containing, at 
teast the following: 

(1) the need far and proposed use ^f such information; 

(2) a statement that all inforaation is to be releasdcJ 

^ or indicating the extent of t!ie information to be releasedTand 

(3) ' a statenrtlnt that such infor^t Ton will not' be giyen, ^ 
sold,* transferred, or in any way relayed to any other person or 
entity not specified in the consent former notice without first , 
obtaining the individual's addition^ written conse^on a form 
stating the need for the proposed -^new use of such inllrmat ion or 
the need. for its transfer to another person or entity, and, 

(4) a statement th^^ such consent applies only to the 
release or transfer of cotifident ial health care information 
existing prior tcr-the date such consent is signed, except 

that when such consent 'is given ih'the course of an application or 
claim. for insurance it shall^also apply to aedical information 
existing at any time during the period ,of contestability pro- 
vided for in the policy and during periods of ongoing proofs of 
loss during a claim. > ^ ^ , ^ 

Section 5. (a) Upon occurrence of an action or decision^f any 
third party, which adversely affects a. person, and which ^^^^'based in^. 
whole or in par^ upon his confidential health care information, in- 
cluding, bi^ not limited to,' the fo^Jowing actions or decisions: 

®^ application fo^^aiviinsurance policy; (2) issuance of 
an insti?dhce policy with other^than Standard and uniXornt restrictions; 
•(3) rejection in whole or in pa'jrtsp^ any claim, for insurance benefits; 
.(4) denial of an employment application or termination of empravment 
when such denial or rterminat ion is forr health reasons; and tipon the 
written request of such person or his authorized representative (<xt^ 
if such person is^deceased, then his ^eir or beneficiary or their * * 
authorized rcprcsoh^ptivc .or his estate) ,^a- thiVd party shall transfer, 
all of such person's confidential health care information in its 
p<»sscssion to rf physician designated in such written request. * 
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1 Prior to Baking such transler, a third party may require paysent 

2 ot its actual cost of retrieval, duplication* and forwarding of such 1 

3 infor«atidn.. ^ 

4 • ' . ' , 

. ^^.W^ physician receiving- confidential health care "Inforaation 

6 pursuant to (a)'abov«^ may review,"interpret and disclose any or all of 

7 such information to the person at whose request stich information was 

8 transferred, as said physician deema In his professional Judgment to 

^9 be in the best interests of the person to whom" such information relates. 

(c) After reviewing his Confidential health care infomatioh 

12 pursuant to this Section, a person or his authorized representative^ 

13 may request the third party to amend or expunge aiiy part' he believes is 

14 in error, or request the addition of any recent relevant information. 

16 Upon receiving such a request, the third party shall notify the • 

17 health care provider 'who initially forwarded such information ^jfo the 

18 third party, and when such health care provider concurs lath such 

19 request, the third party shall return such information to that health , 

20 care provider f or ^aod if icat ion . Prior to making ':3uch return, a 

21 third par^y may require payment of its actual cost of notice, duplica- 

22 tion, and return of such i^orftation/ Except upon court order, the 

23 third party shall not itself modify such-'informatiotS. A persoo-aftef 

24 requesting and reviewing' his confidentiS^ health care information 

25 shall have the right, in any case, to place into the file a statement- 

26 of reasonable length of his view as to the correctness or i'elevance * 
"27 of existitijg information or as to the addition of new informat^n. 

28 Si^ch statement or copies thereof shall, at all times accoi^ny *that 

29 part of the information in 'coht^nt ion . 

30 ( . ► • ^ 
31^ Section 6. (a) (l) Except as provided in subparagraph (2) hereof, ' 

32 confidential health care infontetlort shall not be subject to compul- 

33 sory legal process in any type proceeding, including, but not limited 

34 to, any civil or criminal case or iegislative or j^mlnistrative pro- 

35 ceedirigs or in any pre-trial or other preliminary Proceedings, and a ' 

36 person or his authorised Representative ha» a priv^llege to refuaS 

37 to disclose, and to pryent a witness from disclosing, his confiden- • - 
'38 ^t ial--health care inf 0'faat.ion in any such proceedings'. . ^ 

39 , , 4 . . 

(2) "The exemption from compulsory legal Vz'ocess' and the 
41 privilege provided in suaparagraj* (i) above shall not apply when: 

43 € . 

44 - (A) an individual introduces his physical or mental 

45 condition, including, but- not limited ^0; any alleaation of 

45 mental anguisjk^ mental suffering or similar coiiiition as. ' » 

47^ an^lement ox his ' claim or defense, provided 4hat a claim ^ / 

43 ^ fo^amages or oth^ir fSlief for "pain and suf f ering" iaaed / 

4^ / solely on one * s" ph^icaf' condition doe^ not const it ulfe the/ /i 

• I introduction d'i ono*s mentajl condition into ,iasuo and the/ 

' / oxcnption and priv>ilOKO .shall apply., in such situation as (o 

52 f those portion^; of onojs confidonLial hcnlth c»;rc intornution * -^^^ 

j , , rol;itinj; to montnl, condition. J 
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2 'i, J'"^ ^"''^^""al's physical or aental condition - 

3 ; 11 irotLrr V""'"""''"""" witnessing o"a 
^ wui or otbe^pcuoent ; ^ 



18 
19 
20 



29 
30 
31 
32 
33 
34 
35 
36 



6 * 4 physical or mental condition of a deceased 

^ through or as a beneficiary of such individual; ^^"^^^^ 



(D) in a civil or criminal c^mmitaient proceeding a 



9 
10 

' ev'alJlMnn °' oiagnosis, treatment, or medical 

12 is -lTneed ^■"'i;'""'!. determines that an individual 

13 , tl T^k"^^" °i ""^ treatment in a hospital or any other 

" Wsicia'^'L :f "J'' the-indiOid^'rs 

15 . be appropriate for mental illness; . 

17 h»»n ° i"T """^ *° individual, 'afier halving 

been informed that the communicarions-would not be privileged, 
- ^^^^"^''f =°»»"ni<=«tions to a psychiatrist in the co^se of a 

20 Psychiati-ic examination ordered by the court, provided that 

21 - communications shall be admissible ;>9ly'on iss'ues 
^i -involving the individual "s mental condition; 

23^ 

24 hearl^r^ ^1""^^°^ P"««"ng, including an ex parte 

hearing, it fs demonstrated on a prima facie basis to the 

26 T „ f'! individual's physical or mental condition is 

27 hL^?h T "^^""^ ^^'^""^ *° physical or mental 

28 III another person, or to the security of the United 
3tates, or ' 



(G) in any action an individual pursuant to 
section 9. of this Act, or in any policy action brought 
by an individual against his insurance carrier or- by the 
?arr;er against an insured, or in any other acWon by an 
individual wh,rein it is demonstrated to the court that 
'"f confidential health care information is relevant and " 
37 ^ material then such court may issue an order compellii, 

33 production of such' information. 

^9 (b) The exceptions contained in items (A) throuah <oi of sub- 

40 paragraph (2) above are not intended to prec ude t^Hxemption or 

41 privilege described in subparagraph (i, above in any pretr al or 

43 in^^?i?5ir f State unless the 

44 dXa?-^!^^H °n..hi^ behalf first testifies .as to sucK conf i- ^ 
44 dMitial health care informatHon. 

t "^1 \ • r - - ^ ■ - 

47 • hovi^?^ "J" Notwitjjstandinj other provisions oj this Act 

AS JvailJ^'r^jtdl -Tr' -""'•-tial h^th care\nfor«at on , 

.18 availaU^ t^,««,icai feer review connittoos without authorization.-;^ S 

n„»; <''>/^°°"''«""al health care info^i^nation boforo a medical ' 
• 52 ™n°)^' ""-i" -trit:tly confidential, and any 

53 Shan b^'^M^o. J' °i disclosure of such information 

53 shall be subject to the penalties provided -in this Act, 

t 

♦ ^ \ * • 

X ■ ' ^ ■ . 
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1 . (c) Except as otherwise provided ''in this.^ection, the proceed- 

2 ings and records of medical peer review committees- shall' not be* subject 

3 to discovery or introduction into evidence. No person who was in 
4^. attendance at a meeting of such- committee shall be^ permitted or re- 

5 - quired to testify as fo any^ matters presented during tiie proceedings 

6 of such committee or- as to any findings, recommendations, Evaluations, 

7 opinions or other actions of such committee or any members thereof. * 

8 * ' 



^ Confidential health car| information otherwise discoverable or 

10 admissible from original soulcflfcjs not to be construed as immune ^ ~ ' 

11 .from discovery or use in any proceeding me^ly because thej^ wer« 

12 ✓ presented during proceedings befpj^^such committee, nor is a mem- . * 

13 ber of such commJ.ttee or other person appearing befpre it to be * 

14 prevented from testifying as to matters within his knowledge and in , 

15 accordaijce with the other provisions of this Act, but the said witness 

16 cannot be questioned about his testimony or other proceedings .before 

17 such committee or about opinions formed by him'as a result of said 

18 committee hearings, - * 

19 ' ' • ■ \ 

2p (d) The provisions 'of sub-section (c) above limiting discovery ' 

21 or testimony do not apply in any legal ^action brought by a'medical 

peer Preview committee to restrict or revoke a physician'^ hospital • 
staff privileges, or his license to practice medic ine^ or to cases . ; - 

. , where a member of the medical peer review committee or thC legal ^ 

25 entity which formed such a coomitti^ or within which such committee * 

26 yopPrates^is sued for actions taken by such committee, p^oVldect that ih 

any such legal action personally identifiable portion^ of\a person's 
, 28 confidential he'adth care ;Lnformation shall not be used without. ^ 
29 written authorization of sucb^ person or hds authorized representative 
- • ' * 30 or ujbn court order. _ — — M vtT - 

31 . ^ , ^ ^ . 

.(e) . Nothing\in this Act shall- limit the authority, which may 

^ 33 othenifise be provided by law, of a physician /licensfing or disciplinary - 

" board of this State to require a medical peer review committee to ' 

iiiWW''^ 35 report it any disciplinary actions or recoTOiendations of such 

36- <;omi6ittee, or to;^transfer to it records -of such committee's proceedings 

' 37 or'lactions, including confidential' medical information, or 'restrict 

38 or revoke a physician's license to prac'tice medicine, provided thaJt 

39 in any such legal action personally identifiable portions of a * 

40 ( person's confidential health care information shall not bemused with- 

41 our writtert authorizat ion of sitth person or his authorized" *repre- > 

42 sentative or upon coui^ order, <{ ' 
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43 

^ (f) No member- of ^ medical peer review committee nor the legal* 

45 'entity which formed or within *h\ch suc!>' committee operates 'nor any 

46 person providing information ito such cpmmitte'e sh^^ll be criminally O 

47 ojr civilly liable for the peVrormance^f any duty, functioL or acti- 

48 yity of such committee""or based upon providing inf ormat ion\o^ such 

49 committee; provided such action is withoutr malice and is" based upon 

50 a reasonable belief that such action is warranted. 

51 • ' ; ' ' • 

52 Section 8. (a) Civil {Penalties - Anyone who violates provisions 

53 of this Act, may be helfl liable /for special and general damages, and 
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punitive daoMiges may be granted for malicious violation of this Act. 

♦ (b> Criminal Penalties - Anyone who intentionally and knowingly ^ 
violates provisions of this Act shall, upon conviction, be fined not BK>re 
than $5,00S^ or imprisoned for not more than one year, or both. 

(c) "The and criminal penalties above shall also be applicable 

to anyone who obtains an individual'^s conf Idential'health care information 
'through the commission of a crime, * " ^ 

Section^9. A person or his authorized representative, shall^ave the 
right, when 1;here is an unreasonable refusal to change the records^'as 
provided in Section 5, to seek through court action the amendment or ex- 
pungement of any part of his confidential health care information in a 
third party's possession which be believes is erroneous. * 

Section 10. Attorney's fees and reasonable costs may be awarded, 
at the discretion of the co^rt, to the successful party in any action 
■^nder this Act,"" 

Section 11. Any agreement purporting to waive the provisions of . . 
this Act' is hereby declared to be againsjC public policy^ and '"^o id. 

Sectj.on 12. If any provision of this Act is held by a court to be 
invalid, such invalidity shall not ;«if feet the remaining prbvisionb 'of 
'this A^t, and to this end the provisions of ^is Act are^ereby declared 
severable. - • • 



Section 13. This Act^shall become effective 
from the date of being signed into law. 



(one year) 
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GENERAL . The 1§M Company adheres to ethical, leg#l and confident;,! 
standards- in vthe hanBring of medical records of its employees Prior 

be''obta,nf.''K i^^^"^'^ "^'^^^^^ information le!eaJe^form) wul 

VnforL^T disclosing^or seeking confidential medical 

information except m an emergency or where such^ disclosure is required 
by law. Management shoul^ notify the involved employee and the 
responsible ^Medlcal De'parTment of the circumstan^s nlcessSatiSa 
■personnel ^^^fj^^^^^"^ ">«=^i-l information. Nei'ther mana^J^ nor^ 
Personnel will request or a.ccept an employee's medical record Acceqq 
" dLfrtmenr'"' -^^ical records is limited Xo the IBM Medfia? s^a^f ani 
department personnel under' their immediate supervision. 

™s''t?''^P^.fn '^l!^ .Medical Department.; employees 'will be permitted 
access to certain materials in their medical records to which they have 

Lh,-^!? /i^"*" ^r^'" OSHA-data, Public Health data) and Tactull 

medical data such as laboratory tfrsts, blood pressures Dhvsical 
findings (but not including subjecti^ve or interpretivl da-ta^'or'^Scai 
opinions). The. employee does not have right of access to [he ^i^ry 

^RM^MPdi^^^'^'v^.P^^' '"^'^^^^^ "^^^'^ ''hich contains notes^g^he 

IBM Medical staff, or to information obtaii»ed from the patient which thi 
IBM p>iysicians/nurses intended solely for ?heir own usef or to thiS^ 
party communications , including information from managers . However at 
the request of an emp&yee or in the normal course of ?heir du^rel/ IBM 
r vLi^"^^""^^ will^iscuss or interpret this information concerning 

I .hat employee on an individual case basis. The custodian'-of medical 
^f?°''K^'•^^^.*'^u® reasonable precautions to assure the accuracy and 
~ reliability of the d^ta, and will correct any erroneous data. Medical 
fof S^rinployie."' ""^^^^'^^^ ^° interpret medical data from the record 



As appropriate, managers. Personnel, and 'employees, wiil be provided- 
with recommendations coi?cerrfing medical limitations pertainin'g to 
particular 30b requirements, but medically confidential information will 
not be provided to managers or Personnel without the prior consent of 
the employee. ~ ■ - - - - . . • 



Employees must .provide. medical infor-mation to IBM when the Company has 
a need to know such information in order to carry out its policies 
regarding job assignment, benefits, absenteeism, international 
assignments, security. Workmen's Compensation, etc. — / " 



Managetts will not -consult an employee's private physician(s) concerning 
medica^ problems, and should resolve with th« IBM hjedical staff any 
questions concerning proper action. When njanagers require verificatiori 

/of fafcts with medical implications,, -they should request that the 
employbe have the appropriate information sent to "the Medical Department 
for lAiterpretation. Managers > should recognize thkt our~ posture 
''^"blS^"^ confidentiality may result in delay in the resolution of*some 
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MEDICAL RECORDS. Medical records are confidential and private An ^' 
Zlitr^^ h'^^' ""S^"" materials in his ^c^$ationa? 

medical records. Through medical information releases the employee also 
has some control ovef what material in his/her medical record can be 
used, to whom it will be disseminated, and for what purpose. 

All tfiedical information except details of first-aid visits concerning 
the individual employee is to be maintained in one medical record. No 
location will maintain dual medical records on an individual employee. 
There will be\no personally identifiable separate medical record-keepinq 
system, IndiViduals or legitimate authorities^ acting in their behalf!' 
by presenting themselves at the medical records location, may > have 
access to certain information kept in their medical records, and may 
learn how it is to be used. Accessible kinds of information are defined 
below under "leveJts". Identif iabl-e information about an individual 
obtained foQ- business purposes cannotr be used or made available for 
oth^r purposes without the individual's consent. (See section on r 
Voluivfeary Health Screening Examination Program in this index.) Where 
private medical idvic^ is sought, and when there is no performance 
impact and the law permits. Medical is under no obligation to notify 
management of restrictions reflecting the presence of a medical 
condition. 

The individual responsible for the medical-record will correct any " 
Erroneous data contained in the medical v records when such error <is 
identified and documented. .The responsible medical department must take 
all reasonable precautions to, assure the accuracy and reliability^ of the 
data, *and take precautions to prevent misuse of the data. 

This medical-record sy^lfem philosophy involves a concept of levels of 
information and accessibirTHy ; • ^ 



LEV. 



Level I Material to which the employee has legal right, Such, as 
Occupational Safety .and Health Act data. Public Health 
^ta, and other materials stipulated by law. 

Level II 'Medical data whttrh an employee^ should haye the right to 

^ examine and* correct if necessary. This would include j 
. factual medical data that is not subject to opinion or * , * 
^ subjective interpretation, such as' l^aboratory* tests, * ' 
blQOd pressures, physical ^findings. Voluntary Health 
Screeriing Examination Program Results. 

* 4 

^L^vel III Material' to which the employee does not have right of 
access . The* primary- active working medical recor^ 
containing noteV by the physician/ nurse, informaticm ^ 
obtained from, tbe patient, or information obtained witth ^ • 

the patient's' cinsent, - which the 'physician intended • 
solely for his/her* own us^^ in the management of the case- 
-third-party * letters, consultations/ information fro» ^ 
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T.TnllT''^' '^^ =°Pies,of physician\' and hospital 
reports, psychological test data and ilterpreta.tions . ^ 

dn employee or in. the normal course 'of . th*ir duties IBM Mpdir^i 
l^lTn'^T^ interpret .Level III mat^Llfconcerning^^ 

employee on an individual c^se basis. Care must be taken to liSit 

disclosure of Level III material by IBM, Medical personnel 

fm^;v ^",f"^P^^yee's informed consent (Medical Ir^ormation Release) 

rl!lased to Ihtr/^^'''^^^ ^^^^^^ medically, confidential information is 
released to third parties (insurance companies--includi4ig our 'own 
^^""It^^^f^'-^^overnr^ental agencies, and others) except a^: req&d ^by law? 
in which case if feasible the employee should be notified of. the feleas4 
of this information. It is advisable to .contact the employee if there 
IS any question concerning understanding, specificity, arid possible 
consequences of release of medically confidential material^ . 

, A Medical Information Release form must be used for both seeking and 
-giving information. Basically, informed consent specif ^s the purpose, 
lecipient-. source of information requested, is voluntarily executed bv"" 

k ^^vo^T^f employee, is restricted usually to past and present events, 

3 2.nd IS revokable by the employee, 

Except in cases of einergency, releases are appropriate for personal 
physician contact- Non-solicited information from, personal physicians 
responsibility of the personal physician, and .s,uch information 
should be used.wxth discretion within IBM. "it is presumed that the 
sender has been given permission to release this information and that 
he/she, may J?e questioned by IBM for clarification of the information' 
'received. Situations ^wherein the personal physician is also the IBM 
physician, require additional sensitivity. 

^CEASE FORMS. ,^bsence) A sample of ^Jthe form to* secure medical 
information from the personal physician of the employee" is Included in 
Index 6-2. .They are initiated by management but eliminate the manager 
afe middle person in the. response; their use is recommended*. Managers 
sftould flotify the Medical .Department 'and the employee of* the 
j^ircumstanc-es necessitating the request ^or releases. Through use of ■ 
^•Medical Department selfl-addressed_envelopes , etc*,'' provision must be 
rtiade to allow the eniployee to have medically confidential information 

.sent, directly to the Medical Department. Areas or Divisions developing 
th|ir own forms for this purpose or other* uses with medical implications* 

,shpuia inform the Office of the Corporate Medical Director. Location 
Medical ;Departments developing such forms must work through their 
Divisional Area Medical Dee^rtment for consultation and approval. 
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' SPECIAL . PROGRAMS. In certain governmental programs regarding 
handicapped, etc., the law may require release of 'data to appropriate 
IBM personnel or governmental agencies. If individual identif icatioif is 
reqti'ested,; the specific legal requirements should be clarified by IBM 
legal counsel prior ,»to release of information. 

PR^G AND ALCOHOI/ ABUSERS . There is ^"Corporate program regarding 
hfendling cases where the job is impacted, when Medical involvement is^ 
management initiated and where performance is impacted, then it should' 
be made clear to the employee^ that Medical must advise, responsible 
management of the basic* illness sp that' the 'proper medical program can* 
be instiituted. Where private medical advice is .sought,, ^and - when there 
is np performance impact and the law permits. Medicaids under no. 
obliga£ion to notify management of restrictions reflecting the presence l 
of a medical condition, ^-s^ \ ^ 

APPLICANTS . Medical wiil not .reveal diagnoses .or o*ther confidential 
medical information to managers or Personnel without pr^qr approval from 
the applicant. If the applicant has a history of drug or alcohol abuse, 
he/she should be counseled to allow Medical to notify management. The 
possibility ,of appropriate medical follow-up should be explained to the 
applicant. The applicant must be notified that we will inform managers 
and Personnel of job restrictions. 

Class III applicants will beiinfonned of their prqblem by .the examining 
physician. The responsible IBM Medical Department' will' notify Personnel 
of the Class III designation. In these cases regulations on emplvjyment * 
of ,the handicap^>ed may apply. The Employment Manager should consult 
with the responsible IBM Physician on the appropriate course of action, 
which may Anclude advice on how best to communicate the employment ' 
decision toAthe applicant. Each case should be handled on* an individual 
basis, withVhe utmost sensitivity to the applicant's perception of the 
"decision. It is extremely important that the/ file be carefully and 
thoroughly documented. 

The IBM Medi^^cal Department willXnotify Class II applicants 'of their 
medical ^>rolilems and job restrictions -and also of the fact that managers 
and Personnel, or other* persons in the Company with a need to know, will 
receive a^copy of the job restrictions. \ 

When special, t^sts such as urine chromajography for drugs are carried 
out, i^ is neces^ajry to inform the applicant whaft: the test is for and 
also that there fneiy be some legal requirement to report positive 
resuljts. ^ . ^ f 

Go^^ernmental regulations* may necessitate notifying/ ap^>licants when >fehey \ 
have /a hc^ndicap classification. ' ^ ^ 

LEGAL ' REQUIREMENT . * Certain aigencies such as Workmen's Compensation* 
Boards, Public Health agencies. Occupational Safety and Health Act, and 
other regulatory agencie's operating under other laws^ may have legal 
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right to confidential materi£« with," group or. 
identification. ■ • ^ . ' 



at .times, individual 



In other instances, they may have' the. legal right to* reauest sucl^ 
inforn^ation birt fanly^eeivc it with trie Vprova^ of' "15^ affLted 
"io!^n^M"?''- , "^^''^^ Departments shojli. seek, the help of iJm legal 
counsel for clarification to avoid; erroneous interpretation. ' 

HAZARDOUS OR COMPLEX SITUATIONS AND CASES. There are situations wherJ 
creStls'^'a hLarf pi^bliHTTeriously impacts^ performanc^or. 

L ^" such instances, when ethically appropriate ,„ 

^^^i^ necessary to protect the individual, his/her cd-Workersr 

coJnse?ld tTllll^°"lf^'^' instituted. The employee should bH^rongg 
n^nff^;^^ ^ allow. Medical to release the minimum of medically 
™!nfif appropriate instructions can be giten to- 

managers f irst-aicTteams (e.g., diabetic or epileptic employees) it' 
hShfr ^^'"-'"v/"'''^' it IS for the 'benefit^ of^ the l^/llyel' aS 

~f^™^,- "^''^r ' wish v-to reieks^:- minimal amounts pf " 

to ™fow L'"to'''r/' responsibility to the' co^pag-. 

__to aiiow U5 tp take some reasonable action. Instructions to first-" 

™ ?PP''?g5i^*'® first-aid assistance may compromise somer aspects 

?Lt^f,\?d nfn'^^'^r^'^^'^^^' would; be an extremely rare situation 

th^t would necessitate revealing a diagnosis. •- - . ' '-■^""^ 

- I^flllC^ OF MEDI^ INf6rmATI0N . Managers mai?- occasional^ request 
the Medical Department- t-o verify certain statements of' , fact or 
(v2ri^vina "that""f overtones which a^' employle| presents <1p them 
offi^ \ ^ "^^^^ H ^" emergency room or doctor's • 

t^ft^;onfH ^" f3ct,f'inake certtfin recommendations. 

SUssffbllilv °P reqJ^4rements). It is management?;,; 

respofisibility.to request ^, that the .employee procure ' statements or 
p;:ovide->4scumentatioh whi^:h can .then be sent directly to ^e Selfcal 
Department Tl>r interpretation.' f neaicai 

2^ > CONTACT (INCLUDING ' -TELEPHONE CAL'ls) BY MANAGERS . These are- 

^^^r ^""^ MedlHil-DiglrtiSgKrTssS^s. Only in an emergencj 
should a member of the Medical staff .visit or contact the home of an 
employee without consent,^ and then only after consideration of othe? 
optioi|s (local authorities,. .familV contacti, personal physician e?c.h 
haraf^en? ^'^^^i'^" <^ ^« considered .invaLon of privacy oi 



pmoiovL V f ? members. shiuld be made only.,«ith pe^ission of the 
employee, e:<cept in emergency situations or in cases of a psychologicar 
state where understanding may befuckang (See Index 4-2) ^ ^ ° ogicai 



C2iHiWid£o. wnen seeking consultation, the IBM practiciT regarding the 
Compa^^— -right to r^ues^ consultation and /Ihe employee's 

sh^lSle exllainL%o°ri^"^ "'^^i^^ ^ °!/^'^« consultation 

the employee. Reference may bfe made to the About, 
booklet: "The company, in deciding whether or not yoITi^? 
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entitled to benefits, mayfe-equire an examination by a physician . of the 
company's choice. The company's decision is final,*" \^ 

TAPE RECORDERS. Tape recorders are ntft to be used for recording 
employee- phy&ician conversations. The responsible Medical Director's 
approval and the employee's approval are required when recordings, 
films, or TV tapes are proposed to be made for educational purposes, 

INTERNATIONAL ASSIGNMENTS . (Refer to Index 2-5.) The international 
^assignment physical examination progreun is designed to benefit the 
employee and his/her family.,- and protect them from difficult medical 
situations when on international assignment. The IBM Medical 
p.epartments may require certain medical information concerning the 
employee or his/her family members , so that- proper administrative 
recommendations can be made to management. It *i^ the responsibility of 
the employee and family members to .provide required infStmation to the 
^IBM JltdiAl^pepaxtme IBM must be ^specially sensitive concerning 

handling f cqnfidertti^al information about individuals who are not 

IBM employees. * ' ^ * 

As outlined under the International Assignment Transfer Instructions, an 
individual and family members (of legal age) may individually be given 
medical summaries regarding their individual medical status, - IBM 
Medical Departments must be al^rt to realize that medical information 
regarding an adult' (and certain information concerning minors) is 
restricted to the individual concerned. Discretion and sensitivity must 
be used to avoid potentially embarrassing situations to the individual ^ 
or family memb^s, and toAthe IBM Company. 

MEDICAL CARE ORGANIZATIONS . In future years we anticipate* that both our * 
Medical and Benefits programs will be impacted by Health Maintenance 
Organizations, Foundations for Medical Care, etc.,- as regards their 
"total' care" of the patient. The relationship between each HMO, 
Foundation, etc.,«the employee, and IBM must be understood to avoid 
conflict. * ^ 

' . • . . I 

BENEFITS PROGRAM . The proper administration of the Total and Permanent 
Disability Plan necessitates divulging some medically confidential 
information at the Corporate level. Medical confidence is maintained up 
to the final levels of decision-making, at which time an IBM physician 
is available to release and interpret only the material necessary for a 
decision to be made. 

VOLUNTARY HEALTH SCREENING ExXmiNATION PROGRAM . In ^keeping with the 
intent of the- f/oluntary Health Screening /Examination Pifogram and IBM ' 
concepts of* hedical data privacy and/ confidentiality', information 
obtained from the examination is not to bfe us^ed to restrict an ^employee." * * 
without his or her prior approval. / 

j M^i • ' ' 

Information in the medical data bank is confidential and, except as 
required by^ law, its use is governed 'by these privacy guidelines'. 
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Correction of erroneous material in the dqta bank is required when 
documented ♦ Correctib^ of ma^rial in the data bank should be discussed 
with the Medical Data Center personnel. As originally intended, release 
of the VHSEP printout continue^ to be restricted Jisee next paragraph) to 
licensed practitioners of medicine* Release of the printout (with the 
employee's- approval) to other health organizations or individual 
practitioners would depend on acceptable practice in the community. 

Routine^ employees will not be, given the VHSEP* printout, but upon* 
specific request, a copy of the printout must be provided to them. 
Printouts are considered' Level II material, 

MEDICAL/PERSO.NNEL REVIEW COMMITTEE MEETINGS , These are conducted at 
many lQcatijt5ns-^_. Medi cal.-personnel must be aware that in such meetings 
there is the possibility of medically confidential information being 
discussed or divulged* Medical must be careful not to divulge any 
unreleased confidential matierial. 



MEDICAL- RECORD UPDATE , To adhere to IBM's philosophy concerning medical 
records , it is important that review of restrictions as compared to 
Current medical status of the employee be done periodically .to eliminate 
unnecessary or outdated restrictions, V/l\en accurately documented 
objective information reveals erroneous material in the medical records^ 
including computer records, correction is required. Medical records are 
not to be' purged, but incorrect items are. left intact and the error 
noted-, and a corrected statement made. ^ » 

NEDICAL-RECORD RETENTION , * Medical records on actjive employees should be 
retained intact without time limits. Stored records on fopner employees 
should be ^ maintained according to Corporate Headquarters Record 
Retention Standards or. until the statute of limitations expires, or the 
le'gal requirements of OSHA or other governmental agencies expire, 
depeni3ing on which comes last, when medical records are sent to 
storage, they* will be handled in accordance with the holder's usual 
^methods of storing records. 
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IBM CONFIDENTIAL ~ ' ^ ^ 

MEDICAL INFORMATION REQUEST ^RELEASE 

(Use to Secure Informa 

The purpoS"©— ^of obtaining, .medical- information is <;o assess an 
individuals health stcKtius as it relates'to th^ work environment) 'assist 
in rehabilitation/ \ and. determine eli^bilfty for sickness and accident 
benefits. This i=p:foVR«fcion willj;^^ used by\lBM medical personnel in'^ a 
confidential manner and will noe^^ ^released, unless requirejd by law^. ^ 



To/ 



'^(Print Physician's or^'HospitS^l Name) 
(Address) 



~ (Area Code and Telephone Number) 



T - * ' ^ 

, , r— . ' hereby authorize and. 

^ (Print? Employee' s Name) 
request you to r^elease to the IBM CorporatiOQ Medical Department a summary 
of hospital and/or medical records in your possession concerning my 

illness and treatment during the -period commencing O ^ 

\ (Date) 

as requested 'by that department. 



^ ^(IBM Location) 
(Address) . 



Signed , / . ^ Efate 

I ~ * . 

Witness . * / - ' Date 

r ' 

Previous to use; by the IBM Medical Department " the individual may limit 
or withdraw this authorization by contacting the IBM Corporation Medical^ 
Department or his/her ,-manager, * ^ 



cc: Employee ^ 
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^ MEDICAL INFORMATION RELEASE " - - 

* (Use to Release Information* from IBM) 

This information should be used in. a .confidential manner and unless required 
by law is not intended for ^se by bthers than the i:ecipient. 

TO IBM MEDICAL DEPARTMENT:/ 

^' , , > , hereby authorize you- to ' release 

(Print Employee's Name) 



to 

Z (Print I^ame of Physician or Hospital) 



'(Address) 



(Area Code and Telephone Number) 

/ 

a summary of my medical records in your^-pc^ession pertaining to* 

^ t and covering the period 

(Subject or Illness) . 

» * , 

fro'" ■ through 

(Datfe) ^ . (Date) 

Signed ** D^te 



Witness ^ Date 

; ^ , t^' ~ ; 

ft ^ * • 

Previobs to compliance by the IBM Medical Department the individual may ' 
limit or withdraw this authorization by contacting the responsible IBM 
Medical Department in writing*' 

cc: . Employee 



IBM 



CONFIDENTIAL 



PHYSICIAN S REPORT TO MEDICAL DEPARTMENT 



To the Aurixl.n*) ri»vNK»jn • 

V<Mi aif iiinM'.tnl 10 coHipiric yxiion C of ihu form and forward it in tho occomponying pre addressed envelop** iVie 
' iMtoitiitiu.'i v<»|.i>iiMl Will Im <i Ill .1 cnnl»lcnt»jl ninnncf to nstst in rehabilitating your poticnt arxi in siunsmg his ehg<btlity for 
b«nc(iit uiwfi'f tur con»pany'$ Sickness and Accident Plan 

llic achviiics of ihc company's medical departm«nt in rehabihtation are carried oot m dost co-operatton with theattervJirtg 



physician. 



Mcdi;fal Director 



Sf CHON A 1 0 l>c comjletcd by tfic employcc'j manager 



Miu 



twf n«m« 



f{v«n n^mci 



ADDRESS _ 
DEPT NO _ 
MANAGER 



OCCUPATION 



LENGTH OF SERVICE . 



FIRST FULL DAY OF ABSENCE 



This « 



wpf>lefTv«ni3»y 



ceport^ 



Today's Date 



SECTION B - To be co^npieted by employee (plCase print or typ6> 
TO 1^ ' 



pl^vt'cao I nam* 



ltt«phonf no. 



I tiereby autlioriic you to supply tite informanon requested 



r — 2 — 7 

SLCTION C • Altendino P^iysician's Report 

1. \ Date of examif>atton on which this report is based 



vpiagnosis, including any complications 



.19- 



GENERAL 



REHABILITATION 



Operation (if any). 

\ 



.Date- 



s' IsdisabUity'flferesultof: JLLNESS NON INDUSTRIAL O INDUSTRIAL □ 
JNJURY NQW'INDUSTRIAL □ ' ^INDUSTRIAL □ 



When in yourjudocment should employee be able to rejurn to work? 

a) to Vegular occupation full time ^ 

b) to regular occupation part time 

c) to a lighter occupation full time 



I^EWARKS AWD 
WORK LIMITATIONS 



19. 
19. 
19 . 
19 . 



d) to a lighter occupation part time 

N.B. IBM tfiec \o arrange suitable tntepm ptaccnient when indicated, in the 
belief th.ll It ts m the employee's best interests to resume work , even if 
limited, y soon as physically able. , 

y 



5. Do you wi^h ihh company's Medicjl Director to cnntbct you with respect 
to the rehabilitation of your patient^'^ YES O NO O 



DATE. 



19. 



' A(fdfC^% (if other ilwn m SeciKKi Bl 



.M.D. 
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5. HEW DRAFT POLICIES ON CONFIDENTIALITY FOR PROFESSIONAL STANDARDS REVIEW ORGANIZATIONS, 1975 

\ 



For the purposes of this paper, the following dcfmitions shall apply: 

A. PSRO Dcta aiH^ Information 

D^ia and .inforroaiioii^ Which is acquired and/or gcncraieJd by any PSRO^ 

B. Individual PSRO Data and Information 

. (^mpuicr or hard copy data and information idcmiBablc lo a jpcciSc ,odi- 

C. Identifiable Data of Information 

Data and ,nformat,o-n collected, generated or aggregated on a particular indi- 
vidua! which identi6cs that individual cilheV cxpliciUy or by impHation. 

^ D. Privileged Data and Information ^ , * 

Medical data and information idenU6able to an individual patient, data and 
r mformation indicating pattern, of health care' pnctice. identifiable to indi- 
\J . "ic . P"^"»'o"er». records of PSRO determinations idenufiable 
to individual health care praaitioners a^d data and .nformatiou collected 
• a/fd.or generated fcft medical care evaluations studies « defined m department 
regulations and guidelines * 

E. Monitoring' 

. "The rcMewanrfappraisaJof PSRO functions. 

F. Evaluadon » , 
The determination of program effectiveness and the impact'jf the PSRO 
program on quality of care and'-utilnation of service*. 

G. PSRO Review System r - ^ , ■ 

fjocTn '""^J"'"'^ '"^ supporting component which assist 

the PSRO ,n the r^jiew proctf5ij>r are fumishca PSRO dau for administrative 
puT,«« under Titles 18. 1?. and 5 of the Social Secunty Act, The system may 
include (but IS noc limited io): ^v-'g ' 

I. Hosplial(s).irdelegate{l review authonty \" 

PSRO activity within the health care facility • 

5 Medicare Intermediar>(s) ^ 

V 5, T^TsRb ""'^^^^^^^ : ' 

6 .\redicaid State Agencies apd Fiscal Agen^ 

7 PSRO Contractor, (any independent vendor. proMdirig dkta or dau . 
processing serMccs to the PSRO) V V5 or dau * 

a Medicare Carrier. - 7^ ^ , 

9. Otiier PSROs 

lO.-DtfEVV * ' ■ * , 

1 1 PSRO Support Center. * * ^ » . 

12. State PSRO Council 

15. StaJc .\faiernal and Child Health AgeiKies (Tiile ^ 

. H; Health ^^are Practitioners. . - ' , 

rh'rrul'"x?!."' '^^^ P^^^^'^'<'n^t^^^o are' reimbursed for services , ' 
through .Nre^icare. Afedicai<i. or Afatf rnal and Child ||e^th program, 

I .^HealthCareFacnitles , ' , 

0^ani.ati6ns:ind institution, involved in the dehvery of health care services 

(eg. hospitals. „ur.ing homes. outp«,>nt fadliti'c*. et<8) 

3. Sanction Proceedings * * - ^ 

Procedyres under Section 1 ISranc^ilfiO of the Social 5«^uritv krt 
with'th^ f/^r^r.i: „ t . J * ^"'Jty Act commencing • 

^ with the forwarding of^sanction report by the fSRO under Section 1157. 

' K. PSRO Deliberatiohs Or . 

c'^ideTe iLTnaS'pSRoT' «^""""'>^ <«^" ^^rm^of r^cor^ings which ' 
evidence internal PSRO discussions pertaining to reviey or ^nction^ * 
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Policy Statements 



1. Notification to Public 

The PSRO must mabltsh and impkroent 3 procedure for public notification 
of the existence, scope and purposes of PSRO data s>^teth . • 

2. Notificatidn-io Patients, Practitioners* and Providers 

The PSRO must establish and implement procedures^ to inform individual 
pancrnts. health care practitioners and health caie facilities on whom PSRO 
data and information has been or u being col^lectec as (o' 
a the name, title and address of the person immediately responsible for the 

PSRO datasvstem 
b those who will hi\e access to the file " 
c the circumstances under which and the purposes for which PSRO data and 

information will be disclosed 
The procedures for notification* should be administratively efficient, but 
provide at a minimum fo? general notiflcauon of the above. 

3. Obtaining Access to own P^RO Data and information 

Subject'^to restrictions on disclosure of PSRO deliberations (see #19). 
patients, health care practitioners and health care facilities must be allowed 
access, upon request, to their individual PSRO data and information for 
purposes of ascertaining* the accuracy of that data and information The 
PSRO must establish and implement procedures to \enfy the accuracy of the 
data^d information, the data and information to be accessed shall not be 
physically removed and/or transmiUcd outside of the PSRO. 

4. Patient Access: Special Procedures 

\Vhen''a patient requests access to PSRO data and information under pafa* 
graph 3 above, the phv^icians of record must be notified in writing at least 
ten working days pnor to pauent access jThe patient will not require 
physician authorization to access his individual PSRO dau ^nd information 
nor can^the'^^lmician prevent patient access to the data and information. 
'However. ifTipftn^ rcceiving^ notification of intended patient access, a physi- 
cian of record objects to the release of such information without clarifies.- 
tion. he or his designee may be present when t^e patient accesses his 
individual file to make such clarification. 

5. Limitation on Data Collection 

The PSRO or any agent« organ izauon or instit^ion acting on its behalf as a 
coUectof^ processor and /or reviewer of infotmnon %ust limit the collection 
of PSRO dau and information to that necessiry for the purposes of PSRO 
review and/o^saluation. ' 

6. Limitation on Data Access 

Each component of the PSI^O review system wilt have acceu only to that 

PSRO information and daU necessary lo cary out its functiorinvithin the 
system. / 

Limitations on Establishment of a Natioi^l PSRO Data Base 

Privileged data and informatioq shall notroe stored in a manner which con. 
stitutes creation of a national PSRO database 

8. Codification of Personal Identifiers 

Identification of individual patients. Hbaith care practitioners and health 
. care facilities on PSRO gen«rated repbrts and forms must be in a coded 
form except for \enficatfbn purposes ai provided for in paragraph 3 above. 
Index fiie< containing cross reference/of codes to names of patients. praC' 
titioners and facilities will be maintained in a secure manner within the 
PSRO jeview system. 

9. Purgation: Computer Files 

Computer files may be marntained/indcfitiitely. Iiowever. each PSRO must 
purge such files of all personal ttfclitificrs as soon as such identifiers are no 
longer necessary (guidehnes4«comrnending time periods will be developed) 
for purposes of review, appeals, program monitoring and program evalu- 
atioii. 

10. Purgation of Hard Copy 

Privileged information maintairKd in hard copy must be purged when tKat 
information I has served the specific purpose for which it was geiwrated. 
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11. Responsibility for Confidentiality Vested fn a Single fndivldusi 

A single individual within Che PSRO must be assigned- the resp<jnsibiliiy for 
nuimainuJg liie conftdennahiy of PSRO data within the PSRO review ' 
^ - system and fot-the* nettficarjo^i to DHr\V of any breache»-<>f-<:onfkIe'iuialHy~ 
* " wiihm il»c review^Ts^tmu -A-ptaiV for fmplcmolriiTgrthis responsibility will 
be submitted to DHEW for approval "^.^ 

: 12. Responsibility of Officers and Employees 

AU officers and emplo>eei of the PSRO and^omponenis of the PSRO review 
>>stcm njust \k made aware of their responsibility to maintain the coiifi- 
dcftxiality of PSRO data and informanon and of'the legal penalties which 
ma> be assessed for unauthorimi disclosure of PSRO data or mforjnaiion 
(i.c, fined not more tbaii SLOOO and/or imprisoned not more than six 
months, utider section 1166(b) of the Social Security Act). 

13. Authorized Access: Requiremefits 

An individual officer or employee *,f ^ component of the PSRO review 
system may not be authonrcd access to privileged TSRO data and informa* 
tion until chat individual; / ^ - - . ' 

a- Has completed a training program in the handJing of such data and in- 

tormauon punuant to paragraph 14 beloy; and 
^ b Has signed a statement indicating that- (1) the individual rccogniies hu 
. responsibility to hold the data in confidence, and (2) is aware of the legal 

penalties which may be assessed for unauthorized disclosure of such data 

and information (i e . fined not more than $1,000 and/or impnsoned not 

more than six months). 

- 14. Training Requirements 

It IS the responsibility of the PSRO to provide in ongoing program of 
traintng in tbc handling of PSRO privileged information for th<J officen 
and amplojjees of PSRO review sysiem components authorized to handle 
sucn data. 

15. Access to Hard Copy 

Each acc«s to privileged data and information wTifch requires removal of 
the data or information outside of a PSRO review system component, must 
be recorded m such a manner as to. indicate what material was accessed 
purpo^. when, by whom, where the material was uken. ant^when returned. 
A separate log shall be kept recording access to- the index codi fife (see 
paragraph 8). This log shall indicate the purpose of acces5. when, and^ 
whom. , ^ 

16. Disclosure: Licensing Boards 

Copies of sanction reports forwarded to the Secreury of DHEW under 
Section 157 of the Social Security Act may at the same time be forwarded 
tojtate hcensing boards However, the practitioner or facility must be noti- . 
ficd in writing at least 15 working days prior to disclosure to permit the 
submission of a statement to accompany the disclosed sanaion report. If 

PSRO shall inform the licensing board of the DHEW deierminatiofi within 
a reasonable time after determination is made. 

17. Disclosure: Civil Utigatlon I 

205/hr f\T''''.°c' ^"^''"""^ administrative hearing, under section 
205(b) of the Socul Security Act, privileged data and information. PSRO 
sanction reports and PSRO deliberations shall not be subject to subpeor^ ' 
or discovery p^ding, in any civil action; nor shall any PSRO meiS 
employee or consultant be subject to subpeojia or discovery proceedings for^-. , 
the purpose of obtaining information relating to the above. ' 

18. Disclosure: CJalms Appeals 

- In claims appe'ali disclosure of privileged data or information to other than 
the claimant or his representative must be limited to those parties inv6lv^ 
in the appeals process 

19. Disclosure: PSRO DeUberatlons ^ 

PSRO deliberation, concerning gatienti, praciitioncn and fadiitia which ' 
serve as a baitt of PSRO decisions slVall, not be disclosed outside the >SRO. 
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20. Disclosure: Sanction Procee^ngs ' , . -"^''^ ^ 

^ Subjea to rcgulaiious gQVcniuVgf .atfn^inrtiraijvc hf4rtogi juoiJitr section 
205(b) of the Social Sccumy Act. , an*d 'prpvisibivc for> juc(ic1ah rcVicw. 
privileged (lata and fiifortnation and ^iidioif ^^p<^ti may l>e dis^Ios^d for 
purposes of sanciWn pr6c«dings, but disclosure -is litnitfid^io j^hysi<;iSuis or 
facihucs subject 10 sanction or thefr reprise uia lives, the a)>propriaie Slate- 
Aside Cbuiicil for purposes pf review and.coramctu! and the , Secretary or b« 
s^udiorwcd representatives* for purpoi^iof sancuoi(^eiermi nations ' • 

2t. Disclosure: Results of Sanction Proceedings , 

If sanctions arc levied on health ^cafe.practitfoners, or health care proyidcTi 
^ by the Secretary purs.uant to Sccuoii U60^(h)(2)?Mie hamcf f U»c sanctioned 
pi^tjr. the action taken and the nature dt. the sm^ction mu^i 1>e made a, 
mMterfof pubiic rccord-Tiy both the Searciary %e PSRO.J* > ^ 

22. Disclosure: Monitoring, Review and Ev^uaUBiu > ♦ 

For purposes ol Federal and State program monHormg. rcvj'ew. and cvalu< 
atioii, privileged flata and information may onlf 3fc Skccss^d* by^n^siie *'Uus 
w the i»Sp.O or the other components of the PSRO review system i« whic^ 
ihe privileged daia aiidyor informadoli is siorcd. Privileged information or 
data ihav not be physically removed and/or trammitied oui3\dc of tijp 
PSRO review jystcm excepi/or the purpose of appeal* or sanc;ioris Pursuant 
10 paragraph -#8 all pnyjlcged information and data needed for'moni|onng 
^rid program review purposes must contain ail personal identififatftfn tn a 
codcji^fonrj ' , » , v 

23. (>(Wosure: Health care facility Information ' ' 

Non-privileged data and., information ac((u)jced and/or generated by any 
PSRO, its agents or a'lrciUary components supporung;PS,kO review which ' 
is uniquely' identifiable to a^gfven health care facility may be diS<;;losed upon 
reqi^esi and pttyment of aCfce to cover the expense i»f ^copying the requested 
infornitriidn."HbW^v^r, the li^alth^xare facility must notified in writing 
30 days prior lo disdosUrjs^o^rJiyjLthe facility to review, the information 
for accuracy and to'proyide romi^ents io. a«:Om{>ajny the disclosed irt(qnna- , 
, , tion, 1 ' ' , . ^ " ^ ' * " 

\ ' ' ' ,y * 

24. Disclosure: Non^privIleg^Mfhforhiatlon - 

Noii privilegcd, information and reports generated within the PSRO may, 
' be d,iKlo«d to, individuals, orgajiizations and instnudons updh request ^nd 
p^iymcnt of ajfee to cqv€? the expense of copying* the requesi^rnfortnaiion. 



.The following statement was adopted by an overwhelming 
majority of the Board: ^ 



"Medical reco^tds, for these purposes, are any materials 
* relating to a pjersofi's physical of mental health prepared for 
retention in permanent form in the possession of any custodian* 
of medical records, 

>* 

B, "Anv person may, on request, have access to and the right 
to haye.-G<ipie5._^ his/her own medical records in the* possession 
of his/her doctor, a hospital or any other custodian. of medical 
records., - ' ' , 

"Persons other than the patient may have access to the* 
I>atient*s medical records only: (1) if the .patient has given 
voluntary and informed consent .in, writing to t^e person ^seeking 
access ot the' release of rec6rds for' a specific, use, proviie'ia 
that the record will not be used for any other use; or (2) i£ 
the person claims access by virtue of a subpoena, of which the 
patient has been given notice and the usual opportunity to con- 
•'test it prior -to itfe exe'cution; or (37 if the^recbrds relate,- 
to a communicable disease that a health department or 'other " 
government ag:ency is reauired by law to identify and control, 
where th*e law forbids disclosure of th>s information for any 
;other purpose and the patient, ^ when possible, is given nof^ice 
of .the leg^l requirement^; or' (4) if material from tHe records 
is to be used in connection with medical, or scholarly research/ 
or publication ' of a case history, or arfy other r<efiated. writing, 
in which event -the identity of the patient:' niust he disguised • 
in accordance with^ appropriate* professional standards, and sub- • 
ject" to professional disciplinary review;" 
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SJUMMARY OF ETHICAL HEALTH *DATA CENtERS CONCEPT » " 



Brief Summary of the 
Joint Task Group on I^thical Health' Data Centers 



♦The Joint Task Group w^s appointed in 1973, by the PresideAt of 
the Medipal Society of the County of Erie, artd by the Chairman of the 
'Committee* on Data Processing, Medical ^ociety of the State of New York. 
The purpose was to form a muUiSisciplinary team to explore t|ie poten- 
tial utility of electronic data processing and rcfe^ed scientific disciplines, 
to examine the potential risks attached to computerization of sensitive 
clinical information. ; ^ ^ ^ 

The initial Joint TasK Grloup included physicians, 'representatives 
of the regional nurs«ig.ass,ociation and medicaL record associa|:ion. Soon 
aftftr the first meeting^r the Health Sciences F^iculty of the State University 
of^Wew York at Buffalo offered support, and subsequently, other faculty 
mei;nbers of the University joined the Task Group, providing their 
■ specjai expertise. The Tfisk Group ipet regularly, eveiry week. The 
various menxbers had special background in ethics, broad competence in 
philosopl^y, law and jurisprudence, comptiter sciences, information re* 
^ ^ trieval, sociology, health care^ planning* ^t>d various areas related to 
health care. The Joint Task Group also invited experts from operating, 
data systems with extensile-data security measured. 

The Joint Task Group's deliberations were summarized in their 
minutes? .a 100 page <focument available to those interested in the "problem 
of medical confidentiality. The" Joint Task Group developed the following 
^ concepts and recommendations: 

(1) information processing technology, when fi!lly developed, will 
assist clinical medicinje in decision making, it will close the gap between 
existing knowledge and bedside medicine, and it will assist the patient 
^ , by maintaining a' condensed, timely, pertinent medical history, genetic ^ 

and social histojry; t * • "^^^^ 

^ ^ # • ' . } 

, (2) ^computer-based primary medical data must be effectively 

protected in order to maxinQize the benefits ant3. to minimize th^ risks; 
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{3) for adequate protection of primary'tnedical and related* in- 
formation ethical hea^Ith data eienters should he created, with a formal 
code o_£ p^rqfessional conduct, with explicit an4 appropriate operational ^ 

• standards, with clearly defined. '^ata access.policies, -jtnd with adequate ' 
^data security measures^ to provide •medical con£iden,ti«ility; 

(4) such ethical health data centers should be the only 
accep^table way for handling confidential and potentially, sensitive primary 
clinK^al data; ^ ^ ^ . 

(5.) the professional staff oper'a£ing an ethical health data cent'e^r 
shail have proven competence^ in information^processing sciences and . . 
technology, integrity and moral obligation'to provide medical privacy 
to those patients whq have agreed tq Kave their health-related data' 
stored and processed; ^ 

(6) computer-based data handling operations which currently 
process potentially sensitive clinical information should be regulated as ^ 
to data collection, aa^e6B a^^ information release^' so as to conform 
with the ethical standards o^'practice of medicine; *- ;^ 

^ (V) 'the Medical Society v^f th^ State of N^w York,- in cooperation 

' with other appropriate organizations, shall create an agency to inspect; 
accredit and regularly visit etl^3?caljhealth data center* located in New 
York St^e. The American Medical A's^ociatiqn -should make a41 th^ 

* above a national policy; • ' . " . — ♦ 

% ' 

(8) educational programs shall be created, without delay, for 
t^hoso physicians, nurses,^ medical record administrator's, other.health 
related profes^slonals and information scientists. who intend ^to staff « 
ethical health data centers; ' , ' # v , 

(9) effective public education, shall be initiated to explain the * , 
value of confidentiality of medical records, to make the public awafe 

of the emerging threats to medical privacy, and^ inform the public 
what options are available for conserving the confidentiality of primj)^]^ 
medical infoFUiation; ^ ^' * ' . * ^ 

(10) a legal framework shall be dev^lop&dtto protect the autonomy * 
of ethical health data centers, and .to impose punitive measures on violation- 
of Confidential, privileged cneckcal information* 
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GUIDEHNES ON PRESERVING- CONFIDENTIALITY OF MEDICAL RECORDS 
National Assbciation of Blue Shield Plans ' 
Apprpved: . September 3, 1975 



4 

The Issue of- confidentiality of 'medical recotds j^ias become a major concern 
particularly with Che oassage of the Professional ^Standards Review Organisa- 
tion law and lrapendlng\^lslatlon for National Health Insurance; Physicians , 
health Insurance carriers, government officials and others- are ^concerned 
about the potential threat of Indiscriminate access to, and releasing of, 
sensitive patient data. ' . 

From Its Inception, Blue Shield has functioned as a responsible third party 
in assuring the confidentiality of the physlclan-patlent relationship* Ita 
use of medical data has been for two essential purposes: assuring the patient 
right to^ proper payment of medical care and the'jrevlew of the appropriateness 
and necessity of care rendered by physicians and other health care providers. 

By^vlrtue uf thlu 'inclusion into Che relntionshipt Blu^ Shield believes It 
shduld state publ^lcly its policy and outline its current proceliures for main* 
talning the confidentiality of medical ^^^a. ^ 



BlUE SHIELD POSITION 

It is Blue Shield's position that the confidentiality o'^f medical Information 
It ac*cOmulates as a medical prepayment organization must be assured* The 
conBequende of improper disclosure of medical data entrusted to a Plan can 
•be decrlmencal Co the pacicnc, che physician and the particular Blue Shield 
*Plan. 

Each Blue Shield Plan, therefore, has a legal and eth:'cal responsibility to 
administer effective safeguards. The aim 'p^ these safeguards Is to permit 
autrhorlzed access to the information while maintaining the integrity 'of the 
confld|r)tlal relationship between patient"^ physician and. Blue ShleXd. ^ 

GUIDELINES OF CONFIDENTIALITY 

Blue Shield Plana have always administered procedures to safeguard medical 
Information* The Intent of the followlng^uldellnes la to tuggeat a rtvlay 
of those procedures already In existence or to Implement programs which may 
be necessary to achieve the objective of Assuring the conf lde|itlallty of 
medical information. ' ^ 



PUBLIC ACCESS AND RELEASE OF DATA* 

It should be recognized that a Blue Shi.eld Plan Is a third party to the ? 
pnt lent-physician relationship. Since Blue Shield's file is n scppndary 
duplicate ropy of the physic lap's primary record, there should be'no ne^d 
to Inquire into Blue Shie)d*s file/ Patient inquiries, therefore, regorcUng 
medical data should be referred to the physician. However,, Blue Shield may 
nonetheless become involved In a formal request. Therefore, tfhe following 
guidelines should be applied: 

1. In^general, di^dlcal Information shbuld not be released without a court ' 
order* Whefn under a court order to release cer^ln medical Information, 
the Blue SlHeld JMdn should release only the specific Information re- 
quested. Releaseliof data- beyond thjt whlcK is requested Is a violation 
of the xofif identlality of the data. ' ^ " 
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Me^lical information should never be released oVer the telephone. 

. y ■ " . - 

Although* tKe Plan may be authorized ^to release i'nformatlon, it must not 
do BO b)r telephone. The Plan has no proof that the person receiving 
tlie d^ta is, in fact, the individuaf authorized^to receive it* 

dical information may be released in the aggregate^ora, hoyever, ^ 
requests for such data should be in writing and -should include .the pur- 
pose for which the data will be used. , 

It is ftequently'necessary to release medical data for purposes of 
research for the study of Utilization trends. The data must not, however, 
identify patient, subscriber or physician. 

Additionally, the 'Plan must Know who is Requesting the information, and 
to the best of its ability, assure that the data will be utilized in a . 
proper manner. No valid determination to permit or refuse release can 
be made without this data. ' ' 

Medical information may also be released to the extent necessary for 
appropriate peer review bodies to assist in claims determination relative 
to costs anj quality of care. 

Tn tljese situations, patient identification should be deleted. In ' 
addition, physician identification should also be deleted unless a peer 
review organization deems it essential to the review. When the identity 
of the physician is essential, the physician should be notified, 

« ♦ * o » 

ADMINISTRATIVE RESPONSTBILITY 

The Chief Executive Officer should appoint specific officers or admini- 
strative employees who have the responsibl^lity of authorising rslease 
of medical inf ormatjion . * 

litis assists the Plan in making certain^hat rslease pf infonurtion has 
been properly authorized and reduces confusion over the reqUTteoients that 
must be met . , 

When in doubt, the Plan should rely upon its legal counsel to deternine 
the appropriateness of a request for information and the extent of any 
release of .medical data. ^ 

This assures the Plan that questionable requests receive the necessary 
legal considerations and' that any release of information has met the 
proper legal requirements. 



lyrERNAL ACgESS AND HANDLING OF MEUICAt INFORMATION 

Access to medical information should be limited to ^ "need to know" basis. 

Confidential information implies reatrirtlon to the least niimber of 
people necessary. Indiscriminate access merely compromises those proce- 
dures intended «to safeguard the data. ' ^ 

Adequate orientation and training programs should be developed and main- 
tained which emphasize the sensitivity of medical records and the need 
to maintain their integrity. ' ' 

The orientation and training program on the need, to preserve confidential- 
ity should be given hlgh^ priority and consist of both oral and written 
present^ations. In addition, periodic re-orientations on confidentiality 
of medjlcal data should be conducted. If safeguards are not adequately met 
an invasion of privacy may occur involving both the employee and* the Plan. 



Plan eaployeea should seek only chose ddta necessary. to adjudicate a 
claim, case or utilization patterns and profiles. 



For example, if the Plan needs only a- discharge summary or consultation 
r*epQrt, it should no^ ask the hospital or physician for the entire^ reca 
To do so, Hot only, cre^t^s storage problems, but .also places unne^ 
Imrtiens on tliose mechanisms: which *are meant to ingtir^ j*nnf -fHpnf^/il^fy . 

Adequate security precautions sjiould be Implemented to limit accesa to 
comiiuters and data banks to "those operating the systems. 

The masaive amount of information collected by a Plan requires the use 
pf automated data systems to perform its fv^nctlons in an efficient and 
timely Planner . This consolidation of daCa In. computer stora'ge banks or 
magnetic tapes facilitates easy access to, and retrieval of, Information 
by anyone capable of operating the systems or copying tajJes. 




Employees ahould be encouraged to handle confidential data in a profei- 
slonal manner . > * 



Confidential information should not be discussed except (or the purpose 
of adjudicating ,a cl»lm. 



In addition to a review of existing safeguard procedures, Plans are encouraged 
to communicate their activities to their subscribers ^nd physician^. It is 
essential' that their understanding and cooperation be gained in order that 
any procedures implemented by the -Plao may be effectively administered. 
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* 9» Policies and Recommendations for Policies » American Society of Internal Medicine 

A. Statement on Confidentiality of Medical Records, Approved November, 1973 

Background * 

Concerns relating to the cinfi(}entiality of medical records ^are increasing as 
the involvement of third 'parties in health care delivery is expanded. These concerns 
are heightened by poorly defined authorizations fo£ release of information and by the 
increasing capability of machines for communicati/ig interrelated identifiable patient 
information without the patj.ent*e knowledge and approval. 

Evaluation ^ . *■ 

^ The right of the patient to confidentiality of his medical records is irrevocable. 

Third parties seeking any exception shoi^ld be charged with the responsibility of folly 
informing patients o| the possible consequences of such exceptions, and use by third 
parties of any privileged information must be limited to the purpose for, which it was * 
solicited. ^ ^ 

^ Current laws do not adequately protect a patient's' rights. The American Society 
of Internal Medicine believes that there is an immediate need for legislation which' * . , 
protects persofial data on individual citizens and groups of citizens, . We believe 
that there is a potential for personal injury or abuse by "authorized users," 

s 

Policy Statement ' ' 

~ The American Society of Internal Medicine will work through the appropriate 
legislati-^e channels aiid appropriate professional organizations for a law whicih will 
provide due process guarantees. fheBQ^^.guarantees of confidentiality are to include 
security, accuracy, provision for chstnge , knowledge of purpose, and informed permission 
^ for use. • ' • ^ 

B. Data Control by Government Programs ^ 

Background - - ,^ * 

There is a history of physiciem difficulty in obtaining data aggregated by 
government programs . \ , ' "* . i 

' ^4 ' " * » ' ^ 

Evaluation a . * > ' 

The govermjent is increasingly involved in information gathering arid there seems 
to 'be a naturaD^endency by those who pay for data to exercise total^ owjiership 
prohibiting reSf^nable and necessary acce&s. We are concerned gibout giccess to informa- 
tion generated iff*'the process of "'logical care. We believe that access to data from 
federal prograins mus.:jk^j)e proyjded ii^ order that ttje data itself -may be subjected to 
scrutiny regarding -ii^es si ty, 'appropriateness and quality* 

* * r.^ " ^ ' ' * 

Policy 

' The iyaerican Society of Internal Medicine believes that the right of access to 
data by a (djata subject, either an individual or an orgeoiization, is irrevocable. 

0. Excerpt from Proposed Policy for ASIM Contained in Heport on Confidentiality^ 
^■^^* ^<:)nferenge Committee C, from Board 'Of Trustees ♦Jgebruary, 1^73 . ^ 

Definitions 

1. Thepi^aa?y--cnr^ermanent record belongs to the physician and his patient. 
It is^ihe-iJ^manent data base which meets peer requirements for sufficiency and its 

^ -^release should not occur except with dual consent and then only for the purpose of 
treatment or patient management. The single exception to this consent requirement* 
is ,the instemce of legal action in which case record usage requires. due pVocess 
guarantees. The Primary Record may not Contain notes made and retained by the 
physician solely fdr his p^ersonal use. 
< ■ ' * * ♦ ♦ 

2. The active (working) record is the property of a physician and is solely for 
his personal uSe in connection .with the diagnosis or treatment of a patient gind is 
privileged unless such privilegea are used to affect the patient's rights, benefits 
or liabilities, in which case its use is sub'ject to due process requirements. .The ^ 
active record may contain notes which ^he, physician intended solely for his own use. 

5. Secondary data should be released only in a minimum set of data elements 
which will fulfill a "demonstrated need," and then only with the authorization of the 
,data subject(s|* . ^ z'' 

. - ' . / 
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^4, Certain secondary records use^ in audit or peer review should be prjivileeed 
and prohibited from being admitted in court proceedings. ^ 



Life Span 



iTThe life span of an adult's permanent record should be no less than five 
years from the data of last activity (data entry) unless surgery has been performed^ 
In this instMQ^, it should be kept' for at leaat ten yeats unless the patient dies/ 
The rercord should be maintained for a period of (at least) two years after death,', 

• 2, The minor's permanent record should be maintained for at least five years 
u ^L^?^^^^'^^ adulthood. If .surgery has been performed on' a minor, the record* 
Should be preserved for a' minimum o^f ten years after the patient becomek an adult 
under state law, A 

5. Priiaary medical records for mentally incompetent persons should be maintained 
throughout the individual's lifetime without regard ta activity since statutory 
limitation may never prohibit suit for alleged malpractice. 

4. The life span of a secondary record with pati.ent iden,tity should correspond - 
xactly to the period required to accomplish specific objectives for wijich it was 



e 

obtained 




10, Members of the IIBS/ACM Wor£shop on Privacy. February 8-9 > 1973 



Chairman: 'Alan ?. Westin, Profes.sor of Public'law and ^ ' 

Go-fernment, Columbia University, New York City • 

Stanley J. Aronoff , State Senator, Ohio ' , 

Melvin ?• Bockelman^ Computer Systems Division, Kansas City, Hissoux^^ / ■ \ 

Police Department, *. % • ^ [ 

Walter K. Carlson, Corporate Consultant on Marketing, IBM Corporation V/ 

Russell L. Fenwick, Vice President, Bank of Americ^', San Francisco ' * ^ 

John L. Gentile, Deputy Director, Illin^s Department of Finance 

Lance Hoffman, i^rofessor of Electrical Engineering & Computer Science, " 

Univ-ers^ity of California,:. Berkeley r- 

Seymour Jeffrey, Institute for Computer Sciences and Technology, , * ' ' 

National Bureau of Standards • * , . - ' 

• ' ' ^ ^ / ; ^ 

Michael Kepplinger, Office pf ^Computer Information, IJational Bureau^f Standards 
Paul F.'Krueger, Deputy Chief, Statistical Policy Division, ^ 

U. S. Office of 14anagement & JBudget r , 

.Dr. teter G.^Lykos, Program Director,. SpciiaX RefeearcK' Resource % - 
National Science Foundation 

♦ David B, H,. Martin, Exebutire Director; Committee on Automated Personal 
Data Systems, Department of Health, Education and Welfare 

Anthony G^.^tUnger, Professor oX Applied 1-Iath^atlcs , Harvard 'University 

James £• Ri3,ey> Legal Counsel, UlflVAC; Blue BeU, Pennfey%.vania • ' ' 

Herbert Saxon, Manager, Public Safety ^ Civil Systems Departr^t, 
, , System fievelopment Corporation, Sarxta Monica, California 

" "John H,. F., Shattuck, American Civil Liberties Union, New York City '* . 

'Rein Tiirn, Rand Corporation, Santa' tlbni9a, California ^ , 



11* Persons Attending Draft Repoxt Review Conference > September 16-17, 1975. 
G a i the r s burk , Maryland ' * — , 

Chairman: Dr. Vernon \vilson, Vanderbilt University, Nashville, Tennessee 
Robert R. Belair, Domestic Council Committee on the Right of Privacy 
Colonel Rudolph G» Bickel, M.D., U. S. Air Force 

Mary Converse, Bureau of Professional Services, American Hospital Association' 

Robert 'H. 'Couigtney,' Manag^er, Da'ta Security and Privacy, IBM Corporation 

Royal Crystal, Bureau of Quality Assurance, Department of Health, Education, 
and Welfare- ' 

Hope Eastman, Associate Director, Washington Office, Amel-lcan CiviP Liberties 
Union . ^ 

John P, Panning, Special Assistant to the, Director, Office of Policy Development 
& Planning, Office of the Assist.ant Secretary for Health 

Maurice Grossman, M.D.,, Clinical Professor of Psychiatry,., Stanford University 

Daniel K» Harris, American Medical Association 

Carnault Jackson, M.D. , San Antonio, Texas 

David^B, H. MaAin, Administrative Conferencje of the United States 

Peter F. McCloskey, President, Computer and Business Equipment Manufacturers 
Association ' ^ , ^ . 

\ Dr» Robert H, Mugge, National Health Center for Health Statistic? Public Health 
. Service, U. S. Departmeht of Health, Education and Welfare 

Carole Parsons, Executive Director, Privacy Protection Study Qpmmission ^ 

• Elaine 0, Patrikas, Chair, Department of Health Records Administration, College 
of Allied Health Professions, Temple University 

Elizabeth Price, J)irector, -Professional Services, American Medical Records'' 
Association ^ . 

Jack Richardson, IBM Corporation o , 

Quincy Rodgers*, Executive Director, Domesrtic Council Committee on the Right 
- s ^, t(^ Privacy * o 

Walter Ruben^tein, Social Security Administration ' i w ' 

Vergil N, Slee, M.D», President, Commission on Professional and*^ Hospital 

Activities ' - , ' * - i' \ 

Joseph Terdiman, Kaiser Hospital, Oakland, Caii^u|Sia - . ' i - ^ 

' Willis Ware, Rand Corporation, Santa Monica, Cal^^fnia ) , . 

Lawrence Weed, M,D,,* Director, PROMIS Laboratory, University' of Vermont, 
^ • ' '^j^ Burlington, Vermont'' : ' ' ) / ^ 

■ r V * ' " ; X' • -; 

From the Medical, Records Project Staff: . ^ . : 

Alan F. Westin. - . 

Michael A» Baker 

^..^^glp-^Helene Toiv ' / ^ . , 

From the National Bureau of Standa^s^: 

• Ruth M. Davis . • 

Seymour Jeffrey 

» ^ Michael l^epplinger 

John L. Berg ' 
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